Notifications
Clear all
Topic starter
02/08/2026 11:24 am
TL;DR: Claude Cowork runs with real user sessions, browser access, scheduled tasks, and connector permissions, so prompt injection can move from conversation leakage to file exfiltration, command execution, and persistence, according to Akto. The governing issue is blast radius, not model accuracy: once the agent can act as the user, conventional chatbot controls stop being sufficient.
NHIMG editorial — based on content published by Akto: Agentic AI Security Top 6 Claude Cowork Security Risks to Watch
By the numbers:
- Within 48 hours of Cowork's launch, researchers showed a Word document with invisible 1-point white text instructing Cowork to find financial documents and upload them to an attacker's account.
- Anthropic self-reports a ~1% success rate even after mitigations.
Questions worth separating out
Q: What breaks when an AI agent is given real user sessions and tool access?
A: The main failure is that a single injected instruction can inherit the user's active permissions and convert a reading task into exfiltration, command execution, or message sending.
Q: Why do local AI agents complicate identity and access management?
A: They can retain legitimate permissions while changing timing, prioritisation, and action sequence outside human presence.
Q: What do security teams get wrong about AI compliance?
A: They often treat AI compliance as a model review exercise and miss the surrounding identity and access layer.
Practitioner guidance
- Inventory every agent attachment and reachable system Document which files, browser sessions, connectors, MCP servers, and desktop-control paths each agent can reach.
- Constrain agent permissions to the smallest viable scope Disable web search unless needed, prefer read-only connectors, scope file access to dedicated folders, and keep scheduled tasks and computer-use features off until there is a documented business need.
- Add runtime guardrails for dangerous action chains Inspect agent behaviour as it happens and block patterns such as bulk reads followed by external writes, connector sends to unknown destinations, and connections to unapproved endpoints before the session completes.
What's in the full article
Akto's full post covers the operational detail this post intentionally leaves for the source:
- A step-by-step breakdown of six specific Cowork risks, including prompt injection, browser access, and scheduled-task persistence.
- Operational hardening actions for managed-settings.json, MDM policy, and runtime guardrails.
- Concrete examples of alert conditions for SIEM monitoring, including scheduled-task creation and connector writes.
- Guidance on when to disable Computer Use, web search, or non-read-only connectors in enterprise environments.
👉 Read Akto's analysis of Claude Cowork security risks and agent blast radius →
Claude Cowork security risks: are your controls keeping up?
Explore further
02/08/2026 12:41 pm
Blast-radius control is the defining governance concept for agentic AI. The article shows that a local agent is dangerous not because it is conversational, but because it inherits the user's reach into files, browser sessions, and enterprise tools. Once that happens, the central question becomes how much harm one injected instruction can do before containment fails. For IAM and PAM teams, agent identity must be governed by reachable systems, not by whether the model is conversational or autonomous.
A question worth separating out:
Q: How should organisations govern scheduled tasks in AI agents?
A: Treat scheduled-task creation as privileged access, not a convenience feature. Any task that can repeatedly read files, call tools, or transmit data should be approved, monitored, and revocable on demand. Without that control, a one-time prompt injection can become recurring persistence.
👉 Read our full editorial: Claude Cowork security risks show why agent blast radius matters
