Claude Cowork Sandbox (Short Hub)

Cowork runs agent work in isolated sandboxes (cloud by default; some desktop deployments still use local VM isolation). This page is a pointer—not a second copy of the full security guide.

Read these first

Security model — Isolation boundaries, file access, and practical safeguards
Cloud vs local sessions — When work runs remotely vs when Desktop must stay connected
Use Claude Cowork safely — Official Help

Two “sandbox” meanings (do not conflate)

Cowork session sandbox — Isolated execution for the Cowork agent loop / code execution, as described in Claude Help architecture and our security guide. Isolation reduces blast radius; it does not mean “files never leave your machine.”
Claude Managed Agents environment sandbox — Platform API environments (Anthropic-managed cloud sandbox or self-hosted). See Managed Agents.

What isolation does and does not do

Does: limit what a misbehaving command can touch, contain accidental damage to the sandbox scope, and give you a cleaner place to test unfamiliar steps.
Does not: make approvals unnecessary — you still confirm folder grants, connectors, and destructive actions yourself.
Does not: mean "nothing leaves your machine." Cloud sessions process remotely by design; isolation reduces local blast radius, not network reality.
Does not: replace backups. If a task can overwrite files, keep a copy before the run regardless of sandboxing.

Sixty-second safety checklist

Approve the smallest folder set the task actually needs.
Connect only the sources the task reads; disconnect when done.
Supervise any step that deletes, overwrites, sends, or spends money.
Keep a fresh backup of anything important before the first run.
When output will be published or acted on, verify it against the source yourself.

Practical takeaway

Approve the smallest folders and connectors needed, supervise destructive or financial actions, and use backups. For depth, stay on the security guide rather than this hub.

Share this article