Security Brief: Claude CoWork

By: Atlas Technica, Atlas Technica

Published: 2026-03-10 · Read time: 5 min · Category: Cybersecurity

Atlas Technica's security brief on Anthropic's Claude CoWork: data protection, governance and auditability considerations for regulated capital markets firms, plus near-term options for proceeding with caution.

!Security Brief: Claude CoWork — 03.10.2026

Anthropic's Claude CoWork is one of the most ambitious agentic AI tools available today. It can read and act on local files, chain multi-step tasks, and automate real work, clearing backlogs of low-level file work that normally soak up analyst time.

For regulated capital markets firms, that combination of power and autonomy is both exciting and risky. Based on our review of Anthropic's current documentation and independent research, Atlas recommends treating CoWork as a high-risk, opt-in tool, with the following attributes:

!Compliance Approved, Pilot Use, Not Production — risk tier guidance for Claude CoWork

We assess the risk to be across two key dimensions.

Data Protection and Exfiltration Risk

CoWork is an agent, not a chatbot. Once granted folder access, it can read, edit, and create files, run multi-step workflows, and combine local and internet access. This unlocks real productivity but significantly expands the blast radius if something goes wrong. Two points are especially important for capital markets:

Prompt injection and hidden instructions

Independent research confirms that hidden instructions in documents or web content can steer agentic tools like CoWork. A single malicious attachment or synced folder can become a pivot point for the exposure of proprietary research, LP information, or MNPI, without a clean forensic record.

No deterministic safety line between data and instructions

Today's LLMs cannot reliably separate "this is content to read" from "this is a command to follow." Vendors, including Anthropic, are investing in defenses, but they are not yet sufficient for regulated production environments. If CoWork can see a file, assume it can move it, and that a complete audit trail may not exist after the fact.

Governance, Auditability, and Defensibility

For institutional clients, the core question is not "is this clever?" but "can we defend this in front of a regulator or an LP?" Right now, CoWork has clear gaps:

No detailed, file-level forensic trail

Claude Enterprise offers admin controls and usage analytics but does not yet provide a consolidated journal of every action CoWork takes: which files it touched, what it changed, and what it transmitted.

Limited tenant-wide visibility into agent behavior

You can see that people are using Claude. You cannot readily answer, "What did this agent do on this portfolio manager's machine on this date?" in the way a compliance officer or external examiner would require.

For SEC and FINRA governed firms, the lack of traceability is fundamentally inconsistent with expectations around books and records, supervisory oversight, and cybersecurity. Until CoWork can produce defensible, regulator-ready evidence of its actions, we continue to view it as high risk for workflows where auditability is non-negotiable.

Near-term options for proceeding with caution

Given the current reality, we recommend clients the following alternative options:

Track A — Tightly Scoped CoWork Pilots

For controlled pilot use cases, we recommend tightly scoped CoWork deployments that limit access to low-sensitivity data, pre-approved users, and managed environments.

• Limit the blast radius to dedicated, low-sensitivity folders away from regulated content.
• Contain usage to a small, pre-approved user group on managed Windows builds.
• Document risk acceptance in writing from business and compliance sponsors, noting that CoWork is a research preview, file-level audit logs are not yet available, and prompt-injection risks are not fully resolved.

Track B — AI with Strong Governance

For production workflows, we recommend Managed Intelligence patterns that keep AI inside the firm's sovereign boundary.

• Sovereign AI enclaves that limit AI access to curated, governed data, not the entire tenant.
• Azure AI Foundry with Purview and DLP for inference, data residency, and forensic logging under your existing Microsoft governance framework.
• Tenant-native platforms that operate entirely within the client's Microsoft environment, inheriting established identity, conditional access, and auditing controls.

Atlas Technica was founded in 2016 with two main goals: to provide the best customer service experience possible for their clients, and to use best-in-class public cloud technology to do so. There is a clear need among hedge funds and other alternative investment firms for an IT provider that will put service first. Atlas Technica's mission is to shoulder the burden of IT management, user support, and cybersecurity compliance, so you don't have to. Atlas Technica has offices located throughout New York, London, California, and Florida.