Claude Cowork security is no longer a developer concern — it’s a board-level question, and the Palo Alto Networks enterprise analysis published this week explains why the framing has shifted so fast.
AI systems are no longer answering questions. They are connecting to enterprise data, invoking tools, making decisions, and executing multi-step workflows across applications without human intervention. Teams are no longer asking if they should use this — they have accepted agentic tools as the reality. But the board and the infosec team are asking a different question: can this capability be secured and controlled at enterprise scale?
The usage data behind this shift is specific. Anthropic pulled data from 1.2 million anonymised Cowork sessions across more than 600,000 organisations and found that more than 90 percent of sessions had nothing to do with software development. Users were running research tasks, drafting documents, preparing reports, managing workflows, and handling the kind of repetitive business operations that pile up across every team in every company. The tool that launched as a developer product is now running business operations at enterprise scale — and the security architecture required for that use case is categorically different from a developer tool running code.
This post applies the security frameworks this series has built since June — the Lethal Trifecta, credential isolation, structural sandboxing — directly to Claude Cowork and ChatGPT Work deployments, and covers what the Palo Alto analysis identifies as the enterprise security gaps that most organizations haven’t closed.
Why Claude Cowork Security Is Harder Than Claude Code Security
Claude Code runs in a terminal, inside a developer’s local environment, typically against a specific codebase with a defined scope. Claude Cowork — and ChatGPT Work — runs across the user’s connected apps, files, browser, and any integrations they’ve authorized. The attack surface is qualitatively different.
The Lethal Trifecta post established the three capabilities that create exploitable sessions: private data access, untrusted content processing, and external communication capability. A Claude Cowork session completing a business research task has all three by design — it accesses the user’s connected files (private data), processes web content during research (untrusted content), and may send emails or update shared documents (external communication). This isn’t a misconfiguration. It’s the intended use case. Which means the security architecture for finished-work agents can’t prevent the Trifecta from assembling — it has to govern what the agent does when it has all three capabilities simultaneously.
This is the precise problem the AI Agent Gateway post’s trust-level enforcement addresses at the infrastructure layer. For Claude Cowork specifically, Anthropic has implemented sandboxed execution at the platform level. Claude Cowork starts every session with a sandboxed micro-VM using Apple Virtualization Framework and a strict folder-permission model on macOS — meaning the agent cannot access files outside its explicitly granted permission scope, and cannot persist state between sessions without explicit user authorization. This is structural isolation at the platform layer, not behavioral isolation at the prompt layer.
ChatGPT Work’s equivalent: OpenAI reports that in adversarial red-teaming, its “auto-review” safeguard blocked 100% of attempts to extract protected data through connected tools. The auto-review layer sits between the agent’s tool calls and the connected applications, reviewing requests against data protection policies before execution. Neither platform’s protection is complete — but both reflect a recognition that finished-work agents require platform-level security architecture, not just system prompt instructions.
The Four Claude Cowork Security Controls Builders Must Add at the Deployment Layer
Platform-level security (Anthropic’s sandbox, OpenAI’s auto-review) covers the agent’s execution environment. Deployment-layer security — what the organization building on or deploying these tools adds — covers the enterprise context those platform protections don’t address.
1. Scope Authorization Before Delegation
Every Claude Cowork or ChatGPT Work session should begin with an explicit scope definition: which files, apps, and data sources this specific task is authorized to access. Not all files the user has access to — specifically the subset the task requires. The JADEPUFFER credential isolation pattern applies directly here: scoped credentials prevent the agent from accessing more than the task requires, even if the platform’s sandboxing allows a broader access range.
In practice: when creating a Cowork task, explicitly list the folders, documents, and applications the task should touch. Don’t authorize “all my Google Drive” for a task that needs one spreadsheet. The platform won’t prevent the broader access — but the discipline of scope authorization before delegation mirrors the architectural security principle that has prevented every JADEPUFFER-class attack in the post-series security architecture.
2. Output Review Gate for External Actions
Any Cowork or ChatGPT Work task that produces an external action — sending an email, posting to a shared workspace, updating a CRM record, making an API call — should have a human review point before that action executes. Both platforms offer approval workflows for consequential actions; enable them for any task touching data that leaves your organization’s boundary.
This is the human override requirement the EU AI Act compliance checklist from this series identified for EU-facing deployments — but it’s also sound security architecture independent of regulatory requirement. An agent that drafts an email for review is recoverable if the draft is wrong. An agent that sends the email autonomously is not. The cost of the review gate is seconds per task. The cost of not having it is the task’s external consequence.
3. Audit Trail for Every Session
The AI Agent Gateway pattern generates a session-level audit record automatically. For Claude Cowork and ChatGPT Work deployments, the equivalent is enabling the session history and activity logging features that both platforms provide, and routing those logs to a durable store outside the platform. Platform-native logs are sufficient for incident investigation. They are not sufficient for regulatory compliance — the EU AI Act’s Article 12 requires six months of event logs stored within the organization’s own environment, not in the platform’s cloud.
For builders deploying Cowork or ChatGPT Work on behalf of enterprise clients, this audit trail requirement is a compliance service deliverable: implement the log forwarding, configure the retention policy, and include the audit trail verification in the monthly monitoring retainer described in yesterday’s AI Compliance Services post.
4. Integration Inventory and Periodic Access Review
Both Claude Cowork and ChatGPT Work grow their integration lists as users connect new apps. Most organizations that have deployed these tools for 60 or more days have granted integrations that were authorized for a specific task and never revoked. An integration inventory — a list of every app connected to the finished-work agent, with the date authorized and the task it was authorized for — is the finished-work agent equivalent of credential isolation: it makes scope creep visible rather than silent.
Quarterly access review of the integration list, with revocation of integrations no longer in active use, is the minimum governance cadence. The Langflow CVE CISA post’s lesson applies: the authorization surface of your agent system is as important as its capability surface.
The Enterprise Deployment Governance Question Both Tools Leave Unanswered
Gartner’s projection that 40% of enterprise applications will embed autonomous agents by the end of 2026 creates an organizational governance gap that neither Claude Cowork’s sandboxed micro-VM nor ChatGPT Work’s auto-review resolves: who in the organization is responsible for defining what finished-work agents are authorized to do, and what happens when an agent’s autonomous action produces an outcome the user didn’t anticipate?
The Enterprise AI Agent Deployment post covered this as a change management problem — the Cisco versus Meta deployment contrast, where Cisco’s explicit organizational accountability and Cowork’s ambiguity about agent ownership produced different outcomes at the same technology maturity. The security architecture is necessary but not sufficient. The governance architecture — who authorizes, who reviews, who owns the audit trail — is what makes the security architecture operationally effective at enterprise scale.
For the full Palo Alto Networks enterprise security analysis, see What It Takes to Secure Claude Cowork Across the AI Enterprise.
The Builder’s Takeaway
Claude Cowork security and ChatGPT Work security require both platform trust — the sandboxed micro-VM, the auto-review safeguard — and deployment-layer governance that the platforms don’t provide: scope authorization before delegation, output review gates for external actions, audit trails in organization-owned storage, and periodic integration access review. The Palo Alto analysis confirms what this series has been building toward since June: the security architecture for finished-work agents isn’t a new problem. It’s the Lethal Trifecta, credential isolation, and structural sandboxing applied to a new product category that makes these patterns necessary by design rather than by misconfiguration. The builders who understand this architecture are the ones enterprise organizations will trust to deploy finished-work agents at scale — and that trust is the competitive advantage that no amount of tool-comparison reading creates without it.
Continue in This Series
- Claude Cowork vs ChatGPT Work — the capability and use-case comparison this security post extends with deployment-layer governance
- Lethal Trifecta — the security framework that finished-work agents complete by design — and how to govern it
- AI Agent Gateway — the infrastructure layer that extends platform-level security with organization-controlled audit trails
- Enterprise AI Agent Deployment — the organizational governance context the Palo Alto analysis identifies as the unsolved enterprise problem
- AI Compliance Services — audit trail implementation for Cowork/ChatGPT Work is a billable compliance service this week
This post is part of The Agentic Protocol’s Work series — the connective infrastructure layer beneath every autonomous pipeline. See also: Lethal Trifecta.