Topic starter
02/08/2026 11:24 am
TL;DR: Claude Cowork runs with real user sessions, browser access, scheduled tasks, and connector permissions, so prompt injection can move from conversation leakage to file exfiltration, command execution, and persistence, according to Akto. The governing issue is blast radius, not model accuracy: once the agent can act as the user, conventional chatbot controls stop being sufficient.
Editorial analysis by NHI Mgmt Group, based on content published by Akto: “Top 6 Claude Cowork Security Risks to Watch”.
Key questions
Q: What breaks when an AI agent is given real user sessions and tool access?
A: The main failure is that a single injected instruction can inherit the user's active permissions and convert a reading task into exfiltration, command execution, or message sending.
Q: Why do real browser sessions make prompt injection more dangerous for AI agents?
A: Real browser sessions let injected instructions operate inside authenticated contexts that already have access to files, cloud consoles and internal apps.
Q: How do security teams know an AI agent is becoming a persistence risk?
A: Watch for unattended task creation, recurring scheduled actions, unexpected connector writes and repeat reads from sensitive directories.
Practitioner guidance
- Inventory every AI agent deployment Map where Claude Cowork or similar agents are running, which accounts they use, which connectors are attached and what data each can reach.
- Restrict agent browsing and web search Disable web search by default, restrict browsing to a tight allowlist and route traffic through your proxy so injected content has fewer paths into sensitive workflows.
- Default all connectors to read-only Scope Slack, GitHub, database and workspace connectors to the minimum permissions required, and review every tool result as untrusted input.
Bottom line: Claude Cowork’s risk profile comes from its ability to act inside real user sessions, not from the chatbot interface itself.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:41 pm
Agent blast radius is the correct governance unit for Claude Cowork. The article is not really about chat quality or model accuracy, it is about how far an AI system can act once it sits inside a user session. That shifts the control question from prompt filtering to privilege containment, connector scoping and execution boundaries. For identity programmes, the relevant unit of control is the action scope attached to the agent, not the conversation it processes.
A few things that frame the scale:
- Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
A question worth separating out:
Q: Should organisations treat AI agent authorization as part of PAM or as a separate control?
A: They should treat it as an extension of privileged access management, not as a separate governance island. AI agents are acting identities with privileged effects, so the same principles apply: short-lived access, explicit approval boundaries, and auditability attached to each action rather than to the platform in general.
👉 Read our full editorial: Claude Cowork security risks show why agent blast radius matters