Is Claude Cowork safe, and what does the open source alternative change?

What Claude Cowork can reach, and how you scope it

Claude Cowork gives Claude real capabilities: reading your files, browsing the web, running code, and using your apps. Anthropic groups the tools into read tools, which access and read content, and write tools, which act in your environment. Anthropic's own guidance is that write tools carry more risk and that people should stay in the loop on high-stakes work (Use Cowork safely).

You scope it in two ways. You choose the folders and tools, and Cowork can reach nothing else, with deletion of a file needing your explicit approval. For an organization, admins set access by team and control tool permissions. A separate setting controls whether members can skip per-task approval for write-capable connector tools, and Anthropic ships that setting off by default (product page; Team and Enterprise article).

Where Cowork data and configuration live

A Cowork task runs in the cloud. Claude's work runs in an isolated, temporary environment on Anthropic's servers, created for that one session, unable to reach your home or company network, and removed when the session ends. When a task needs a local file or your browser, Claude reaches your computer through the Claude Desktop app, and only for the folders you connected.

Anthropic is direct about the limit of that isolation. It protects your computer and network from the code Claude runs, and it does not limit what Claude can read or do through the access you granted. Because the work runs on Anthropic's servers, any local file Claude opens is also processed there rather than only on your computer (Use Cowork safely).

Your sessions and files are saved to your Claude account. An organization can run Cowork in its own Amazon Bedrock, Google Cloud or Microsoft Foundry account instead, but it cannot run Cowork on its own servers. Anthropic documents retention separately: remote session transcripts, which is Cowork in the cloud, are retained for 6 years unless a member deletes the session sooner, and the Claude Team and Enterprise interfaces are not eligible for zero data retention (retention policy).

The question a company asks

The core risk is the pair of things that make a prompt injection possible: Claude reading content outside your trust boundary, and Claude holding an action that can compromise you. Anthropic says the risk of prompt injection is non-zero, and recommends limiting the folders, sites and connectors you grant.

So the questions a security team asks are simple. Can we run this on infrastructure we control? Can we scope each person and each agent to the resources they need? Where do the credentials for our connected tools sit? Can we read every action after the fact? Cowork answers some of these with admin controls and an activity stream to a SIEM through OpenTelemetry, and those controls live inside Anthropic's product and Anthropic's cloud.

What an open-source, self-hosted alternative changes

Kortix is the open-source AI Operating System: your agents, skills, company memory and connectors live in one git repo you own, and every session runs on its own cloud computer. It answers the four questions directly.

• Run it on Kortix Cloud, in your VPC, or on your own on-prem network, and self-host is free.
• Per-resource permissions for people and agents: roles, groups, and an audit trail.
• Connector credentials are brokered server-side and never enter the machine.
• Every action is recorded. The audit log keeps 90 days of events live, and the archive keeps them up to 365 days (Kortix docs).
• One isolated sandbox per session. Each session has its own isolated machine and branch, and session work reaches main through a change request. Merge is default-deny for agents.

The comparison table on this page sets the four tools side by side. If self-hosting is the deciding question, self-hosting on Kortix takes it further, and is Claude Cowork open source? answers the neighboring question. The Kortix team also wrote about the pair on the Kortix blog.