Safety model, enterprise controls, and when not to use Cowork

Cowork is a capable tool. It is also a tool that can modify your files, consume tokens at 5–10× the rate of Chat, and produce plausible-but-wrong outputs if you hand it a vague task and walk away. Understanding where it works, where it doesn't, and what the safety model actually guarantees is the difference between a professional Cowork setup and an expensive mistake.

The six pitfalls that actually bite people

Kitchen-sink sessions. You start a marketing task, ask something unrelated halfway through, and continue with the original work — now with a polluted context window. The fix is /clear between unrelated tasks, or using separate projects so the context never mixes in the first place.

Over-specifying steps. Telling Cowork how to do something instead of what to produce. When you script every step, you hobble the agent — it has to follow your path even when a better one exists. The fix: describe the outcome, name the constraints, define the success criteria, and let it choose the path.

Pointing at root directories. Mounting your entire Documents folder or Desktop on day one. If Cowork makes a mistake with a file it shouldn't have touched, you've just made the consequences much larger than they needed to be. The fix: a dedicated ~/ClaudeCowork/ directory with copies of real files, not originals, until you've built trust with specific workflows.

Treating it like Chat. Short one-liners produce 10% of the value. A message that works fine in Chat ("can you summarise these meeting notes?") produces a thin output in Cowork because Cowork needs a brief, not a question. Write like you're briefing a contractor: objective, inputs, output format, constraints, success criteria.

Assuming it won't make mistakes. Multiple practitioners have reported Cowork producing confident, plausible-but-wrong outputs — competitor information that was outdated, summaries that missed key details, analyses built on misread source files. Cowork produces editable first drafts, not finished work. Always review before using the output.

Not backing up. Cowork can and does modify files. Before any task that involves moving, renaming, or editing existing files, have a backup. Use git, Time Machine, or a manual copy into a separate folder. This is non-negotiable for anything that isn't already in your sandbox/.

The safety model

Cowork's architecture includes several protections that are worth understanding:

• Code execution in an isolated VM. Shell commands and Python run in a virtual machine separate from your operating system. If something goes wrong in the VM, it doesn't affect your OS.
• File access scoped to mounted folders. Cowork can only see and touch the folders you've explicitly granted access to. It cannot roam your filesystem.
• Deletion requires explicit per-operation permission. Cowork will not permanently delete a file without asking you first, every time, for each file.
• Conversation history stored locally. Your session history is stored on your machine, not subject to Anthropic's standard data retention practices.

The gap that matters for enterprise: Cowork activity is not in Anthropic's Audit Logs, Compliance API, or Data Exports. If your organisation requires a full audit trail of AI actions for compliance purposes, Cowork's current architecture does not provide it. This is the enterprise gap — plan accordingly.

When not to use Cowork

Quick lookups and short edits. Agentic loops consume 5–10× the tokens of Chat. If you're asking a single question, checking a fact, or making a small edit, Chat is faster, cheaper, and produces the same output. Cowork is for tasks where multi-step execution and real file output are the point.

HIPAA, FedRAMP, or FSI workloads. Cowork is explicitly not approved for regulated workloads in healthcare, federal, or financial services contexts. The audit log gap is disqualifying. Use Anthropic's enterprise products for those contexts.

Sensitive data on an unfamiliar system. If you're working on a machine you haven't fully reviewed — a shared device, a newly set up computer, a borrowed laptop — don't mount folders containing credentials, secrets, or sensitive PII. Verify the setup first.

Admin controls for Team and Enterprise

If you're deploying Cowork across a team, the admin panel gives you:

• Toggle Cowork on/off org-wide
• Plugin allowlisting and private plugin marketplaces (push approved plugins to everyone, block unapproved ones)
• Web search toggles per role or org-wide
• Claude in Chrome toggles
• OpenTelemetry streaming to your SIEM (for Compliance API mapping — note this is not a replacement for full audit logging)

The plugin allowlist is the most operationally important control for teams. Once you've built and tested a custom plugin for a workflow, you can push it to everyone via the private marketplace and block unapproved plugins from loading. This is how you standardise workflows at scale while maintaining oversight.