What Claude Cowork Can Actually Reach When You Connect a Folder
- Branden Bell
- 6 days ago
- 6 min read
The question I get most about Claude Cowork is some version of "can it get into my stuff." Fair question. The answer everybody repeats is that Cowork only touches folders you connect, which is true, and it's also the part that made me relax when I shouldn't have.
While I was rebuilding my own website with Claude, it wiped a page I had already finished. Not a file inside a connected folder, a live page on the site. The folder boundary held the entire time and had nothing to do with any of it.
So here's the version I wish somebody had handed me, with Anthropic's own words doing most of the work. Verified August 2026.
The sentence nobody quotes
Anthropic's Cowork safety doc has a line in it that reframes the whole question:
Isolation limits where Claude's code runs. It doesn't limit what Claude reads or does.
Read that twice. The containment everybody talks about is real, and it's a claim about where code executes, not about reach. Depending on what you've granted, Claude in a session can still browse the web, read email and documents through your connected apps, work in your connected folders, and act through all of those same channels.
The folder you connect is one of those channels, and treating it like the whole perimeter is the mistake I made.
Where the work actually happens
Cowork sessions run in the cloud by default, currently in beta. The agent loop and any code Claude writes run in an isolated temporary sandbox on Anthropic's infrastructure, created when the session starts and destroyed when it ends.
That sandbox is locked down harder than most people assume:
No network pivot. It can't reach private, internal, link-local or cloud-metadata addresses, so it can't be used to get into your network.
Egress enforced from outside. All traffic leaving the sandbox passes through a mandatory proxy the sandbox can't reconfigure or bypass, and only allow-listed destinations are reachable.
Short-lived credentials only. The sandbox holds session-scoped tokens that expire within hours, and connector authorization tokens never enter it at all, since connector calls happen server side.
When a session needs something on your machine, a local file or your browser, the request goes through the Claude Desktop app on that device. File access is limited to folders you connected there, and each local tool call gets checked against your permissions before it runs. If the desktop app is offline, a cloud session can't reach your computer at all.
It's a good containment story. It just answers a narrower question than the one you're asking.
What a connected folder actually hands over
Anthropic is blunt about this one, and it's the second sentence worth quoting:
Since Claude can read, write, and permanently delete these files, be cautious about granting access to sensitive information like financial documents, credentials, or personal records.
Most people hear folder access and picture Claude reading. The verb in the middle of that sentence is write, and the one after it is permanently delete. Anthropic's advice right after is to make a dedicated working folder instead of granting broad access, and to keep backups.
There's one real brake. Cowork requires your explicit permission before it permanently deletes any files, in every mode, including the one where nothing else asks.
Three doors the folder boundary does not cover
Anthropic sorts Claude's tools into two groups: read tools that access content, and write tools that act in your environment. Write tools are where the risk lives, and your folder list is only one place they show up. Here are the other three:
Connectors. Claude reaches for the most precise tool first, so a connector like Gmail, Drive or Slack gets used before the browser does. Those calls run server side under connector permissions, a separate grant from your folders. Network egress permissions don't apply to web fetch, web search, or MCPs.
The browser. Claude can open Chrome and work on sites, clicking, typing and filling forms. Run a session in the Chrome side panel and Claude can see the page you're on, including pages behind a login.
Computer use. Anthropic's own line is that computer use has no sandbox between Claude and what's on your screen. It asks permission per application, investment, trading and cryptocurrency apps are blocked by default, you can add your own blocklist, and it's a research preview on Pro and Max plans only.
There's a seam in that last one worth knowing about. Claude can only use apps you approved, but if it clicks a link inside an approved app, that link opens anyway, even in an app you never approved. Anthropic can keep Claude from seeing that window. They can't stop the link opening.
The mode you pick does more work than the folder you pick
Cowork has three modes, and this is the setting that actually governs your risk:
Manually approve. Claude pauses and asks. You choose Allow or Deny on each action.
Automatically approve. Claude keeps moving, but reviews every action for safety first and blocks whatever it judges unsafe. That checking consumes more of your usage limit, and the mode is currently on Pro and Max plans only.
Skip all approvals. Nothing checks its actions.
Anthropic's guidance is to switch back to Manually approve when the task touches sensitive files or accounts, when you're using a new tool or site for the first time, and when mistakes would be hard to undo.
Two conditions, not one boundary
The most useful idea in that safety doc is one I haven't seen quoted anywhere. A prompt injection attack needs two things true at once: Claude can read content from outside your trust boundary, and Claude can take actions that could hurt you. Break either one and the attack gets a lot harder.
That reframes the setup question. It's not really "which folder did I connect," it's "is this session reading untrusted content while also holding the ability to act on it."
What this cost me
I wrote the whole rebuild up as a public build, the Claude skill that rebuilds a Wix website, and the About page is the part I keep coming back to.
Claude was working through the Wix editor in a browser. Midway through a batch of edits the editor's focus quietly drifted to a different page, and three removal calls landed on the wrong container. Every edit reported back as landed, and the check that ran right after came back clean, because an empty page has no defects left to find.
Nothing in that sequence was irreversible, destructive, or aimed outside my environment, which is roughly the scope a safety classifier catches. I wrote about that gap when Claude Code made auto mode the default. The folder boundary was intact and the permission model worked as designed. I still lost the page, because what went wrong was judgment inside granted access, and no boundary catches that.
The fix was a focus guard that re-checks before every single write instead of once per batch. That kind of guardrail has to come from you, because it's specific to your work.
How I have mine set up
Nothing clever, and none of it is a recommendation for your business without seeing it:
A dedicated folder per job. Never my whole Documents directory, never anything with financial records or credentials in it.
Manual mode for anything that publishes. Auto is fine when the output is a draft I read before it goes anywhere.
I verify the deliverable, not the log. This one came straight from the About page. A clean run report and a correct result are two different claims.
Questions worth asking before you connect anything
What I run through before pointing Claude at a client folder:
What is actually in this folder? Not what you use it for, what is sitting in it right now.
Is this session going to read anything I did not write? Web pages, inboxes, shared documents, anything from outside.
If it read something hostile mid-task, what could it do with that? That is the second condition.
Would I notice if a step half-succeeded? Half-succeeded is the failure mode that reports success.
What is my undo? If the answer is nothing, use Manually approve.
Sources
Where I land on it
The containment is real and I wouldn't work without it. What it protects is your computer and your network. When people ask whether Cowork is safe they're usually asking something else, closer to whether they're handing over judgment, and that comes down to how you set it up rather than where the code runs.
This expands one paragraph from my longer guide, how to use Claude in 2026, which covers the surfaces, the models and the plans.
If you want help deciding what Claude should be allowed to touch in your business, or you want something built with the guardrails already in it, that's Claude consulting with me. $250 for the first hour, then $75 an hour, hours estimated up front. The intro call is free, fifteen to twenty minutes, me not a sales team. Whatever gets built runs in your Claude account and you own it completely.
Have you connected a folder to Cowork yet? I'm curious what made you hesitate, or what made you decide it was fine.
Comments