Claude Cowork Enterprise Security: CISO Guide 2026

Claude Cowork enterprise security is a category most organizations are not ready for. When Anthropic launched Cowork in January 2026, it moved beyond AI chat into something fundamentally different: an AI agent that can access local files, control browser sessions, execute shell commands, and connect to enterprise systems through MCP connectors. If your team approved Cowork the same way it approved a new SaaS chat tool, the threat model you applied was wrong.

This guide covers what your security team needs to know: the demonstrated attack chains, the audit log gap, the MCP authorization risks, the compliance implications, and a practical hardening checklist built from what enterprise deployments have learned in the nine months since launch.

What Claude Cowork Actually Does (and Why It Is Different)

Most enterprise AI tools operate within a clear boundary: you send text, the model returns text, and the interaction stays inside the application. Claude Cowork breaks that boundary by design.

Cowork is an agentic desktop application. When a user asks it to "summarize the sales contracts in my Downloads folder and flag anything over $500,000," Cowork reads local files directly, processes their content, and can take follow-on actions, including uploading documents, filling web forms, and triggering connected applications through MCP. The product launched on macOS in January 2026 and reached Windows feature parity shortly after.

The capability set that defines Cowork's value creates its attack surface:

• Local file system access: Cowork reads and writes files on the host machine within its granted scope
• Browser session inheritance: Cowork can operate within existing authenticated browser sessions, acting on behalf of the user in web applications without re-authentication
• Shell execution: Cowork can run shell commands on the host system
• MCP connectors: Cowork connects to enterprise systems (Slack, Google Drive, SharePoint, GitHub, Salesforce) through Model Context Protocol connectors configured at the workspace level

Each of these is a lateral movement path. An attacker who can inject instructions into Cowork's context can direct those capabilities against the user's data and connected systems. This is categorically different from an attacker manipulating a chatbot into producing a harmful text response.

The January 2026 File Exfiltration Chain

The first public demonstration of Cowork's attack surface came within 48 hours of its launch.

Security researchers at PromptArmor constructed an attack using a standard Microsoft Word document. They embedded invisible text containing indirect prompt injection instructions that the Cowork agent read as legitimate task instructions. The injected prompt directed Cowork to identify financial documents in the user's accessible folders and upload them to an attacker-controlled Anthropic account. The attack required no additional user approval because folder access had already been granted during onboarding.

The demonstration included files with partial Social Security numbers. The attack chain has three steps: deliver a document through any channel that puts a file in the user's accessible folders, wait for the user to ask Cowork to work with that folder, receive the exfiltrated files. No malware, no stolen credentials, no network exploit. A Word document with invisible text.

The 1% injection success rate that researchers sometimes cite as a theoretical ceiling scales differently at enterprise session volumes. At 1,000 Cowork sessions per day across a 500-person organization, a 1% success rate means 10 successful injections per day. At 10,000 sessions, it is 100.

CVE-2026-21852 documented a related flaw in Claude Code where a malicious repository exfiltrated a developer's Anthropic API key before the user clicked "trust" during project initialization. The underlying pattern is the same: an AI agent with file access and outbound connectivity cannot always distinguish task data from attacker-injected instructions embedded in that data. Patching individual CVEs matters, but the structural risk of agentic file access persists.

CVE-2026-46331: The Sandbox Escape

In July 2026, security researchers disclosed CVE-2026-46331, which they named SharedRoot. The Hacker News covered it under the headline "Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files."

Cowork runs inside a virtual machine designed to isolate its operations from the underlying operating system. SharedRoot exploited a Linux kernel flaw to allow a locally running Cowork session to gain guest root and read or write files across the host Mac's entire filesystem, breaking the VM isolation boundary.

The practical impact: Cowork's VM sandbox is the primary control that limits file access to a user-defined scope. If that sandbox can be escaped, an attacker who injects instructions into a Cowork session can reach SSH keys, browser profile directories containing active session cookies, system credentials, and files belonging to other applications on the host. The scope is the entire machine.

Enterprises should verify they are running a Cowork version that patches CVE-2026-46331 before deploying to any additional users. Validate the sandbox boundary after patching by testing whether a Cowork session can access paths outside its configured scope. Repeat this validation after each major Cowork update.

The Audit Log Blind Spot

Here is the fact that most compliance teams discover only after approving Cowork for deployment: as of mid-2026, Cowork activity is explicitly excluded from all three of Anthropic's compliance mechanisms.

Anthropic provides three enterprise compliance tools:

• Audit Logs: CSV export of up to 180 days of events, accessible to Organization Owners from Admin Settings > Data and Privacy
• Compliance API: Programmatic event feed with approximately 30 typed events covering identity, project lifecycle, conversation lifecycle, and file uploads
• Data Exports: Bulk conversation exports for compliance review

None of these capture Cowork activity. Anthropic's documentation states directly that "Cowork activity is not captured in Audit Logs, Compliance API, or Data Exports." This applies across every plan tier, including Enterprise.

The only native observability channel Anthropic provides for Cowork is OpenTelemetry (OTEL) export. Admins configure an OTEL endpoint that streams session telemetry to a SIEM. This gives session-level visibility: when sessions started and ended, which connectors were invoked, and high-level task outcomes.

What OTEL does not provide is the event-level audit trail that compliance frameworks require. For SOC 2, ISO 27001, GDPR Article 30, and EU AI Act purposes, session telemetry is not a substitute for per-action logs showing which files were read, which external systems were called, and what data left the environment. Enterprises deploying Cowork need supplementary controls: network egress monitoring at the process level, DLP at the file upload boundary, and SIEM correlation rules tuned to Cowork's behavioral patterns.

The gap is not a workaround or a configuration detail. It is Anthropic's current product boundary for Cowork, and it requires explicit acknowledgment in your compliance program.

MCP Connector Authorization Bypass Risks

MCP connectors bridge Cowork to enterprise systems. A Slack connector lets Cowork post to channels, fetch messages, and search history. A GitHub connector lets it read repositories, create issues, and open pull requests. Used correctly, connectors extend Cowork's usefulness significantly.

The security problem is access inheritance in shared workspaces.

When a connector is configured at the workspace level, all workspace members interact with it through a shared authorization context. A finance team member who configured a Google Drive connector using their own credentials may inadvertently give all workspace members access to their Drive scope. A user asking Cowork to "find the Q3 budget" may receive files from a Drive they were never authorized to access in the source system.

The source system's permission model is bypassed because the AI agent is authenticating on behalf of the workspace rather than the individual user. Google Drive's folder permissions, Slack's channel membership controls, and SharePoint's group policies all assume individual user authentication. They were not designed for an AI agent holding a shared authorization token on behalf of a team.

Anthropic introduced enterprise-managed authorization for MCP connectors to address this pattern. The control allows admins to lock connectors to IdP-only authentication, preventing employees from linking personal accounts to workspace tools. When a user leaves the organization or loses IdP group membership, their connector access expires promptly rather than persisting through a long-lived shared token.

For a deeper treatment of MCP security risks and controls in enterprise deployments, see the dedicated guide. The short version for Cowork: every connector should use IdP-bound per-user authentication, token lifetimes should be set to 4 hours or less, and each connector's outbound network access should be scoped to the minimum required endpoints (a GitHub connector needs api.github.com and nothing else).

Shared Context and Data Leakage Across Workspaces

Claude Cowork workspaces include persistent file storage and shared conversation context. When a team member uploads a document or shares a conversation thread, that data is accessible to all workspace members. There is no file-level access control within a Cowork workspace analogous to folder permissions in SharePoint or group-level access in Google Drive.

The consequence is data co-mingling. A finance team member uploading payroll data into a shared workspace makes that data available to everyone who uses the workspace, including the marketing intern and the offshore contractor. A developer pasting database connection strings into a Cowork conversation exposes those credentials workspace-wide. A single compromised Anthropic account grants access to, and the ability to modify or delete, all shared project files in every workspace that account belongs to.

This is the shadow AI problem compressed into a collaboration tool: data that was governed, classified, and access-controlled in its source system enters an environment where those controls do not apply.

The governance control is workspace segmentation by data classification, not by team. A workspace that contains payroll data should include only employees authorized to access payroll data. A workspace for a client engagement should contain only data authorized for that engagement. Treat a Cowork workspace like a shared drive: the access boundary is the workspace boundary, and the data classification of the workspace should reflect the most sensitive data it will ever contain.

Compliance Mapping: GDPR, SOC 2, HIPAA, and EU AI Act

HIPAA: Anthropic's Business Associate Agreement excludes Claude Cowork by name. Cowork may not be used to process protected health information on any plan tier. Healthcare organizations that signed an Anthropic BAA for Claude Enterprise should document Cowork as out-of-scope in their BAA coverage registry and confirm that position in writing with Anthropic before any employee begins using Cowork for clinical or administrative workflows.

GDPR: EU organizations require a signed Data Processing Agreement with Anthropic before using Cowork with personal data. The audit log gap creates a problem for Article 30 (Records of Processing Activities) compliance: organizations must document what personal data their AI systems access and how. OTEL session telemetry does not provide the per-action granularity that an Article 30 record requires. Some European organizations are routing Cowork through their own EU-region cloud endpoints via the Anthropic API, which gives them more control over data residency and processing records.

SOC 2: The audit log gap makes Type II evidence collection for Cowork scope difficult. SOC 2 auditors expect event-level logs showing who accessed what data and when. Session-level OTEL telemetry is not a direct substitute. Enterprises pursuing SOC 2 with Cowork in scope should engage their auditor before deployment to agree on what compensating controls (network egress logs, DLP event logs, SIEM correlation results) will satisfy the evidence requirement for the audit period.

EU AI Act: Use cases that fall under Annex III high-risk categories require a conformity assessment before deployment. Cowork's autonomous task execution, file access, and shell execution capabilities may place specific use cases in scope for high-risk classification depending on their application domain. Anthropic holds ISO/IEC 42001:2023 for AI management systems, which is a meaningful indicator but does not substitute for a use-case-specific risk assessment. The NIST AI Risk Management Framework is a practical starting point for that assessment, and our EU AI Act compliance checklist maps the high-risk categories to common enterprise AI use cases.

Enterprise Hardening Checklist

This checklist reflects controls that should be in place before Cowork is enabled beyond a closely supervised pilot group.

Pre-deployment

• Confirm Enterprise tier (Team plan does not include the admin controls required for Cowork governance)
• Sign and review Anthropic's Data Processing Agreement
• Document Cowork as out-of-scope for your HIPAA BAA in the internal compliance registry
• Complete a data classification review: identify which data types employees will likely process through Cowork and confirm each type is appropriate for the shared workspace model
• Engage your SOC 2 auditor or compliance lead before enabling Cowork to agree on compensating controls

Network and endpoint controls

• Push managed-settings.json via MDM with network egress restricted to an approved domain allowlist
• Start with a restrictive allowlist: api.anthropic.com, your OTEL endpoint, and approved connector domains only
• Disable web search for roles that do not require it as part of their Cowork use cases
• Restrict browser navigation to an approved domain allowlist if browser use is enabled for any team
• Block unapproved MCP server endpoints at the network layer, not just in Cowork's admin console

MCP connector governance

• Require IdP-bound authentication for every connector (no shared service accounts)
• Set maximum token lifetime to 4 hours or less in IdP connector policies
• Maintain a written allowlist of approved MCP servers; block unapproved additions
• Scope each connector's outbound network access to the minimum required backend endpoints
• Review connector authorization logs weekly for access patterns that deviate from expected use

Monitoring and observability

• Configure OTEL export to route Cowork session telemetry to your SIEM
• Build correlation rules that flag: sessions accessing more than 20 files in under 5 minutes; sessions with outbound data volumes above your established baseline; sessions that invoke both file access and external connector calls in the same session
• Deploy DLP on file upload paths to detect PII, credentials, and confidential data before files enter shared workspaces
• Enable per-process network egress monitoring for Cowork specifically, separate from broader endpoint monitoring

Workspace governance

• Segment workspaces by data classification level, not by team or department
• Document the maximum data classification allowed in each workspace
• Prohibit upload of data classified above the workspace's permitted level
• Conduct quarterly reviews of workspace membership and shared file inventories
• Define a written acceptable use policy for Cowork specifying prohibited data types and use cases, and require acknowledgment from all users before first access

Patching

• Verify Cowork is patched against CVE-2026-46331 (SharedRoot) across all employee machines
• Define a maximum patch window for Cowork: 7 days for critical severity, 30 days for high
• Subscribe to Anthropic's security advisory feed and assign someone to triage new disclosures
• Test sandbox integrity after each major Cowork update before re-confirming deployment approval

How BeyondScale Assesses Claude Cowork Deployments

BeyondScale's AI security assessment includes a dedicated Claude Cowork module. We test for prompt injection paths across the file types Cowork commonly processes (Word, PDF, CSV, code files), validate that MCP connector authorization follows least-privilege principles with per-user IdP binding, verify that OTEL telemetry is reaching the SIEM and that correlation rules generate alerts on anomalous session patterns, and review workspace governance against data classification policy.

The assessment produces a prioritized finding report with specific remediation steps. Cowork introduces a new attack surface that standard AI security assessments, designed around chatbot or API security, do not cover. If your team enabled Cowork without a dedicated security review, that gap is active now.

Book an AI security assessment to include Claude Cowork in scope. If you want visibility into your current AI exposure before scheduling a full assessment, scan your AI environment with Securetom for an immediate picture of what AI tools are active and what risks they carry.

Conclusion

Claude Cowork enterprise security is a distinct problem from Claude Enterprise chat security. The agent's local file access, browser control, shell execution, and MCP connectivity create attack paths that prompt filtering and conversation-level monitoring cannot address. The audit log gap means you cannot rely on Anthropic's compliance tools to reconstruct what Cowork did in a session. The shared workspace model creates data co-mingling risks that require explicit governance decisions, not just policy statements.

None of this means Cowork cannot be deployed in a way that manages these risks. It means the hardening work is real, specific, and must happen before broad rollout rather than after the first incident. The file exfiltration chain demonstrated within 48 hours of launch was not a theoretical edge case. It was a demonstration of what the product is capable of without the controls described in this guide in place.

Treat Cowork like what it is: a new class of system access, not another SaaS chat tool.