Is Claude Cowork safe? Where a session's data goes, and the open-source system you own

What Claude Cowork runs, and where it runs it

Claude Cowork is Anthropic's agent for knowledge work. Anthropic's safe-use page describes the shape of a session: the work runs in the cloud, in an isolated, temporary environment on Anthropic's servers, created for that one session, unable to reach your home or company network, and removed when the session ends (checked October 2026).

That isolation bounds where Claude's code runs. It does not bound what Claude reads or does. When a task needs a local file or your browser, Claude reaches your computer through the Claude Desktop app, and only for the folders you have connected. If the app is offline, the session cannot reach your computer. Any file it opens through the app is processed on Anthropic's servers, so the data leaves your machine even when the work started on it.

Connectors and scheduled tasks widen the same surface. A session reads your connected apps through your Claude account, and scheduled tasks keep working in the cloud with no device online.

The real risk surface

Anthropic sorts the tools a session holds into read tools, which access content, and write tools, which act in your environment. Write tools carry more risk, and the safe-use page recommends human oversight in high-stakes work.

The sharpest risk is prompt injection, malicious instructions embedded in content the session reads as part of a legitimate task. For the attack to succeed, two things must be true at the same time: the session can read outside your trusted sources, and it can take an action that matters. Anthropic's own mitigations include content classifiers, action screening in "Automatically approve" mode, and an explicit permission prompt before any permanent file deletion.

Each connected app and MCP extension is another path in. Anthropic notes that desktop extensions and plugins run on your computer with the permissions of any other program, and that web and email content are primary prompt-injection vectors.

The control that erodes fastest is the approval itself. Cowork offers "Manually approve", "Automatically approve", where the model screens each action, and "Skip all approvals", where nothing checks the run. Anthropic ties the mode to the stakes because a task can act on malicious content before anyone notices.

The governance controls a team needs

A single person can govern a desktop assistant by habit. A team cannot. Four controls carry the weight:

• A per-tool rule for every connector, so one tool always runs, another asks first, and another is blocked, down to the arguments of each call.
• Credentials that stay outside the machine where the work runs.
• An audit record of every action, who approved it, and what changed.
• A choice of where the platform itself runs, so a security review is answered with your network rather than a vendor's.

What Kortix changes

Kortix is the open-source AI Operating System, and it answers each control with something you can read. Secrets are encrypted at rest with a key per project. Connector credentials are brokered server-side and never enter the machine. Per-resource permissions for people and agents. Roles, groups, and an audit trail. Approval gates you set. Off until you set them. Session work reaches main through a change request. Merge is default-deny for agents.

The other half is placement. Run it on Kortix Cloud, in your VPC, or on your own on-prem network. Self-host is free. The whole system is one git repo you own. Open source. Read it, fork it, audit it. The code is on Kortix on GitHub, or Try Kortix on the managed cloud.

For the install on your own box, self-hosting Kortix is the walkthrough, and Kortix for teams covers roles and gates. Moving an existing setup is covered in migrating from Claude Cowork, and Read the comparison sets Kortix against the closed platforms.