Claude Cowork Sandbox (Short Hub)

Cowork runs agent work in isolated sandboxes (cloud by default; some desktop deployments still use local VM isolation). This page is a pointer—not a second copy of the full security guide.

Read these first

• Security model — Isolation boundaries, file access, and practical safeguards
• Cloud vs local sessions — When work runs remotely vs when Desktop must stay connected
• Use Claude Cowork safely — Official Help

Two “sandbox” meanings (do not conflate)

1. Cowork session sandbox — Isolated execution for the Cowork agent loop / code execution, as described in Claude Help architecture and our security guide. Isolation reduces blast radius; it does not mean “files never leave your machine.”
2. Claude Managed Agents environment sandbox — Platform API environments (Anthropic-managed cloud sandbox or self-hosted). See Managed Agents.

Practical takeaway

Approve the smallest folders and connectors needed, supervise destructive or financial actions, and use backups. For depth, stay on the security guide rather than this hub.

Related

• Managed Agents
• Safety tips
• Connectors hub