Skip to main content

Security Briefing

Claude AI

Cowork isn’t just a chatbot, it’s an agent that can autonomously execute multi-step workflows including file organization, document generation, research synthesis, and scheduled recurring tasks, all running locally on user machines with the same permissions as the logged-in user. That’s the core danger: it doesn’t have its own restricted identity, it has yours

Abstract visualisation of an AI agent pulling files and documents through a data centre

A few specific failure modes:

  1. 1

    Full user-permission inheritance. Claude Cowork can access any file the logged-in user can access unless you’ve deliberately scoped it down.

  2. 2

    Prompt injection is the real attack vector, not malware. Security researchers have shown attackers can exfiltrate files without stealing credentials, they simply provide their own API key within a prompt injection, causing Claude to upload victim files. This can come from a malicious webpage, email, or document Claude reads as part of a task, it doesn’t need a foothold on the machine first.

  3. 3

    “Act without asking” is the single most dangerous toggle. When enabled, users can let Claude act without asking for approval, including using tools, editing files, and browsing websites which can put organizational data at risk. Anthropic’s own guidance is to disable this: when “always allow” is available, prompt injections can manipulate Claude into taking sensitive actions on websites or performing destructive operations on local files without user consent.

  4. 4

    Shadow AI on personal accounts. Dispatch is available on Pro, Max, and Team plans, and on Pro and Max personal accounts there is no admin toggle, creating the same shadow-AI risk profile as Computer Use for organisations whose employees have personal subscriptions. A staff member on a personal Claude sub could be running Cowork against company files with zero visibility from your side.

  5. 5

    Visibility gap. Traditional endpoint visibility may not fully capture Cowork activity because many operations occur inside the sandboxed environment, so the computer security such as AV and EDR won’t necessarily show you what happened.

Baseline configuration

What “properly set up” actually means

Information from Anthropic’s own guidance and enterprise security write-ups, a defensible Cowork setup looks like:

Laptop with a padlock and permission shield hologram over locked folders

  • Least privilege, dedicated folder. Configure Cowork on the principle of least privilege, maybe a dedicated working folder, Manually Approve as the default, and browser access granted only when needed.
  • Manual approval mode is the default, not “act without asking” per point 4 above.
  • Filesystem exclusions. Restrict the mount points Cowork can access on the local filesystem, exclude ~/.ssh, ~/.aws, credential stores, and any directory containing secrets.
  • Minimum scope per connector. Apply minimum viable scope to every connector, since default connector configurations often request broader permissions than any specific use case requires
  • Only verified extensions. Stick to verified extensions from the Claude Desktop directory, carefully evaluate the permissions any extension or plugin requests before installing, and use marketplace controls to set per-plugin installation preferences. Signed extensions specifically for Cowork on 3P, require signed extensions by setting isDesktopExtensionSignatureRequired: true in your MDM configuration.
  • Per-tool permission stances. Each tool exposed by an MCP server or connector can be set to Allow (runs automatically), Ask (requests permission each time), or Blocked (cannot run at all) tune these per your organisation rather than accepting defaults.
  • Network-level controls. Anthropic supports network-level tenant restrictions, limiting Claude access to approved enterprise tenants only security teams should enforce these on managed corporate networks and devices. Also route Cowork traffic through your existing proxy so your CASB/DLP has visibility into what domains Claude is reaching, even if it can’t inspect agent decision-making.
  • Treat scheduled tasks as a security event. Treat scheduled task creation as a high-priority security signal any new Dispatch task should trigger an alert and require review and audit existing scheduled tasks during any Cowork security assessment, since they may have been created by previous injection attempts.

Microsoft 365 connector

Why Claude in Microsoft is dangerous without sensitivity labels configured

The mechanism is Claude’s Microsoft 365 connector uses delegated permissions as it operates as the signed-in user and can see whatever that user can see in Outlook/SharePoint/OneDrive/Teams. That’s normally described as a safety feature (it can only access what that specific user already has access to; your existing SharePoint permissions, sensitivity labels, and folder-level sharing settings are all respected) — but notice the load-bearing word there: respected. It respects labels that exist. If sensitivity labelling isn’t set up in your tenant, there’s nothing for it to respect.

The critical distinction Microsoft itself draws in its own security whitepaper: sensitivity labels block Copilot access when they’re configured with Microsoft Information Protection (MIP) encryption that restricts the label’s usage rights to specific users or groups, and more importantly, labels with MIP encryption prevent Copilot from summarising a document’s content for users who lack the label’s usage rights even if the user has access to the SharePoint site hosting the document. That’s the actual control layer. Without it, access = visibility, full stop.

Abstract visualisation of shared documents and folders radiating from a central data core

So without sensitivity labels in place, and with PII already sitting unlabelled in SharePoint:

  1. 1

    Broad sharing links become fully surface able. The primary risk: content accessible to “Everyone except external users” or via broad sharing links becomes surface able to any user in the tenant through the AI tool. If a client’s SharePoint has years of “Everyone” or org-wide links (extremely common in SMB environments), Claude will happily pull PII out of those into a chat response for anyone who asks the right natural-language question something that previously required actually knowing the file existed and finding it.

  2. 2

    Every returned document may contain unfiltered PII. Every Microsoft 365 MCP tool call returns the data the authorising user can see, and that data routinely contains PII, PHI, financial records, contracts, source code, secrets, and credentials, none of it is inspected before reaching the AI model’s context window unless you’ve put a DLP layer in front of it.

  3. 3

    Data leaves the Microsoft compliance boundary. Unlike Microsoft 365 Copilot, content retrieved by Claude is processed by Anthropic, so anything pulled out of SharePoint is no longer purely governed by Purview/Compliance Center controls once it’s in the conversation, unless you have ZDR and an enterprise DPA in place.

  4. 4

    Oversharing exposure isn’t visible until you audit it.Microsoft’s own tooling exists specifically because this is a known gap: Microsoft’s content governance tooling includes a SharePoint Assessment report that quantifies oversharing exposure before Copilot deployment, the same exposure applies to any connector using delegated Graph permissions, Claude included. Most SMB tenants have never run this assessment.

  5. 5

    Low-friction connection bypasses IT entirely. On a personal account, a single user can initiate this connection without any admin approval, as long as Microsoft Entra settings allow user consent once connected, Claude gets delegated read access to that user’s Outlook, SharePoint, OneDrive, and Teams data via the Microsoft Graph API, and if Entra isn’t configured to require admin approval for third-party app consent, that app registration is quietly created in the directory. So even if you as the MSP haven’t rolled this out, a client staffer might have already connected it themselves.

Bottom line

Bottom line for your client environments: the fix isn’t “don’t use Claude with M365”, it’s the same fix you’d apply before rolling out Copilot: run a SharePoint oversharing/permissions assessment, get Purview sensitivity labels and auto-labelling policies actually applied to PII-bearing content (SSNs, financial data, contracts) with MIP encryption on the sensitive tiers, lock down “Everyone”-style sharing links, Claude or otherwise goes anywhere near production SharePoint.

https://wonderingaboutai.substack.com/p/is-claude-cowork-safe

Close Menu
LOG A JOB