<h1>Vulnerability in Anthropic’s Cowork AI: A Recurring Security Challenge</h1>
<p>Researchers at PromptArmor have identified a prompt injection vulnerability in Anthropic’s Cowork AI agent, a research-preview feature extending Claude Code capabilities beyond programming tasks. This vulnerability, previously recognized in Claude Code, remains unpatched and allows attackers to exploit Cowork’s functionalities to their advantage.</p>
<h2>The Vulnerability</h2>
<p>The flaw in Cowork allows malicious actors to deceive the AI agent into uploading sensitive files to another Anthropic account via crafted prompts. This security gap leverages Cowork’s abilities to access local folders and send API requests to Anthropic’s trusted domains, effectively bypassing existing network restrictions. Despite acknowledging the risk, Anthropic positions the responsibility on users to restrict access to sensitive files and monitor the AI’s activities, which can be a significant concern given that Cowork is specifically designed for non-technical users. The AI system does require user confirmation before executing actions, but the potential for misunderstanding prompts could still lead to unintended, and possibly damaging, commands.</p>
<h2>Expanding Capabilities with Cowork</h2>
<p>Launched as a feature to expand Claude Code’s applications, Cowork serves enterprise tasks by automating processes like summarizing calendars, crafting reports, and organizing data. It can interface with databases, applications, and browsers to perform tasks simultaneously. This expansion points towards adoption in various knowledge-driven roles, including research and operations, where clear operational boundaries are established. However, the identified security vulnerability adds a layer of risk to deploying Cowork in sensitive environments.</p>
<h2>Ongoing Security Concerns</h2>
<p>This issue with Cowork is reminiscent of earlier vulnerabilities reported in other Anthropic products, notably the Files API exfiltration risk seen in Claude Code last October. Even prior to that, Anthropic faced criticism for inadequate responses to security reports, such as declining to patch an SQL injection vulnerability in MCP server code. Security experts argue for a more proactive approach to such vulnerabilities, suggesting that measures like enhanced API account verification could prevent unauthorized data access.</p>
<p>In conclusion, while Cowork’s ability to automate and streamline enterprise tasks holds significant promise, the persistent security vulnerabilities pose serious challenges. Until Anthropic implements robust technical safeguards, the potential for exploitation remains a cautionary tale for users.</p>


Collections

PromptArmor researchers discovered a prompt injection vulnerability in Anthropic's Cowork AI agent that allows attackers to upload sensitive files to other accounts through crafted prompts. The flaw, previously identified in Claude Code and still unpatched, exploits Cowork's ability to access local folders and send API requests to trusted domains. Anthropic places responsibility on users to restrict file access and monitor AI activities, despite Cowork being designed for non-technical users. This vulnerability echoes earlier security issues in Anthropic products, including Files API exfiltration risks and an unpatched SQL injection vulnerability, raising concerns about the company's approach to security patches and the risks of deploying Cowork in sensitive enterprise environments.

Anthropic's Cowork: Enhancing Productivity Amid Security Concerns