Anthropic's Cowork is one of the most powerful AI tools available today. It brings Claude Code's agentic capabilities to the desktop: Claude can read, edit, and create files on your machine, control your browser, open applications, execute shell commands, and complete multi-step tasks autonomously. It's genuinely useful. It's also genuinely risky if you deploy it without thinking through the implications.
What Cowork actually does
In a regular Claude chat, you type a prompt and get a response. In Cowork, Claude has permission to act. It can access your file system, interact with applications, browse the web on your behalf, and execute code in an isolated VM on your machine. It can work in parallel across multiple workstreams. You can assign it a task and walk away.
For knowledge workers, this is transformative. For security and compliance teams, this is a new attack surface.
The engineer with admin privileges
Here's the scenario that keeps me up at night: an engineer at your company has Cowork enabled on their workstation. That engineer also has admin privileges to your AWS environment, your CI/CD pipeline, your production database, or your identity provider.
Cowork is now one prompt away from making changes to your infrastructure. Not hypothetically. The tool is designed to act autonomously. If it's running in "act without asking" mode, it can execute commands, modify files, and interact with systems without pausing for approval. A poorly worded prompt, a misunderstood instruction, or even a prompt injection from a malicious document could result in unintended changes to production systems, data exposure, or configuration drift that nobody notices until something breaks.
This isn't a flaw in the product. It's working as designed. The risk is in how companies deploy it.
Health tech companies, pay attention
Anthropic's own documentation is clear: "Do not enable Cowork for HIPAA, FedRAMP, or FSI regulated workloads." The BAA explicitly does not cover Cowork. If your employees are using Cowork on machines that have access to PHI, ePHI, or systems that process patient data, you have a compliance gap. Full stop.
The BAA covers the Claude API (Messages API specifically) and Claude Enterprise under certain configurations. It does not cover Cowork, Claude in Chrome, Claude in Excel, or any features currently in beta. If you're a health tech company and your team is using Cowork casually, you need to evaluate that immediately.
What to do
Don't ban Cowork outright. It's a powerful tool and your team will use it regardless if you don't provide guidance. Instead:
Define who can use it and on which machines. Engineers with admin access to production infrastructure probably shouldn't have Cowork running on the same workstation, or at minimum should be using "ask before acting" mode exclusively.
Separate environments. If possible, ensure that machines with Cowork enabled don't have direct access to production systems, sensitive databases, or PHI.
Use the permission controls. Cowork has per-app permissions and an app blocklist. Use them. Block access to infrastructure management consoles, cloud dashboards, and any application where unintended actions could cause real damage.
Train your team. Make sure anyone using Cowork understands that it's not a chatbot. It's an agent that can take real actions on their machine. The difference matters.
The bottom line
Cowork is powerful enough that restricting it entirely would be the wrong call. But letting it run unchecked on machines with production access is equally wrong. The answer is governance: clear policies about who can use it, on which machines, with which permissions, and under which modes.
If you don't have those policies yet, now is the time. Your team is already using these tools. The question is whether they're using them safely.
Up next in the series
In Part 3, we dig into the data layer: BAAs, zero data retention, and what companies actually need to understand about where their data goes when they use AI.
Read Part 3 →
Farbod Fakhrai is the founder of Com-Sec, a cybersecurity and compliance consulting firm supporting startups and growth-stage companies.