A team can enable Claude Code's Bash sandbox and still permit actions on the host desktop. That matters when comparing Code with Cowork: neither product's code-execution boundary contains every action it can take.
The comparison below reflects Anthropic's documentation reviewed on September 7, 2026. We have not run a new isolation test. The controls depend on the installed version, enabled features, and organization settings.
| Action | Claude Code | Claude Cowork |
|---|---|---|
| Code execution | Bash sandbox, when enabled | Isolated code execution |
| File operations | Built-in file tools use permissions separately from Bash | File operations pass through permission checks |
| Host computer use | Optional; runs on the actual desktop | Runs on the actual desktop |
Sources: Code sandbox scope, Code computer use, and Cowork safety guidance. These are execution boundaries, not comparative security scores.
Same architecture, different products#
Cowork and Code share the planning loop, sub-agent delegation, tool selection, and permission scaffolding. What differs is what each product can reach and what enterprise controls Anthropic ships around it.
Claude Code can work with repositories, shell commands, MCP servers, a Chrome bridge, cloud sessions, and Remote Control. It also supports computer use from the CLI, through a built-in MCP server that is off by default. Once enabled, it requests permission for each app per session and operates on the user's desktop.
Claude Cowork supports knowledge work across local files in granted folders, browsing sessions through Claude in Chrome, computer use on host applications, plugins that bundle skills + connectors + sub-agents, scheduled tasks that run on a cadence, projects with persistent memory, and mobile dispatch for assigning tasks remotely.
Compare the enabled features and their controls before deciding which deployment is easier to constrain.
Detect and respond to employee AI agent risk
General Analysis AI Detection and Response monitors employee AI agents across files, browsers, MCP servers, connectors, scheduled work, and downstream business actions. It gives security teams the trace, policy decision, and response workflow needed to stop unsafe data movement.
The sandbox delta#
Claude Code's sandbox model. The Bash sandbox restricts filesystem and network access for Bash subprocesses. Its write boundary is configurable and includes session temporary storage and added working directories. Review exclusions and unsandboxed retries before relying on it as a required control.
Built-in Read, Edit, and Write tools use permissions separately. Computer use reaches the host desktop. Anthropic also describes a separate context window for web fetch as a prompt-injection safeguard. That is not OS isolation or a guarantee that fetched content cannot influence subsequent actions.
Claude Cowork's sandbox model. Anthropic's safety guidance separates isolated code execution, permission-checked file operations, and host computer use. Computer use has no sandbox between Claude and the screen. Review the permitted apps and the accounts already signed in on the desktop.
For either product, trace the action that matters. A sandboxed shell command, a file-tool write, an MCP request, and a desktop click can reach different controls. Approving one boundary does not establish that the others are contained. Our coding-agent security guide describes how to plan that review.
The network and TLS-inspection delta#
Claude Code's network story is well-documented. The corporate-proxy doc explicitly supports HTTP_PROXY, HTTPS_PROXY, and NO_PROXY. Custom CA certificates are trusted via NODE_EXTRA_CA_CERTS. SOCKS proxies are not supported. The cloud-execution path uses isolated Anthropic-managed VMs with their own network access controls. Remote Control sessions move data over TLS using multiple short-lived, narrowly scoped credentials. WebDAV is explicitly flagged as a Windows risk. Each path is named, and each path has documented behavior.
Cowork has explicit egress exclusions. Anthropic's safety guidance says network egress permissions do not apply to web fetch, web search, or MCPs, including Claude in Chrome. A code-execution egress policy therefore cannot establish coverage for those other paths.
Validate native model traffic, code execution, browser traffic, MCP calls, and desktop-app traffic separately for both products. Code's documented proxy variables do not establish that every program it launches or app it controls uses that proxy. Cowork's web-tool and MCP exclusions likewise require separate review. Record where each request originates and which control can observe or block it; the Cowork deployment guide expands that inventory.
The audit and enforcement delta#
This is the section that decides what evidence each product can produce and which controls still have to sit in the execution path.
Both products now have session-transcript coverage. Anthropic added remote Cowork sessions on August 3, local Cowork and Code sessions on August 11, and moved those session endpoints out of beta on August 26, 2026. The Compliance API can return supported session metadata and transcripts with a Compliance Access Key carrying read:compliance_user_data.
Coverage still has boundaries. Capture starts only after the Primary Owner enables the Compliance API, and missed local-session transcripts cannot be recovered. The API excludes Code on the web, Code authenticated through the Claude Platform, Bedrock and Vertex sessions, and some local sessions under ZDR or HIPAA-ready configurations. Session transcripts omit thinking blocks, binary content, and some configuration metadata.
The larger difference is enforcement. The Compliance API retrieves records after activity occurs. Code adds repository boundaries, managed settings, network controls, and ConfigChange hooks. Computer use in either product operates on the host desktop, so app permissions, endpoint telemetry, browser controls, and approval remain part of the control plan. For PHI, the answer is simpler: Anthropic's BAA excludes Cowork, even though its supported sessions are now visible through the Compliance API.
MCP and plugin control delta#
Claude Code exposes managed-mcp.json and allowedMcpServers / deniedMcpServers, but their scope depends on the session and how a connector arrives. The MCP documentation distinguishes terminal sessions, cloud sessions, and Desktop local or SSH sessions. In particular, Desktop-delivered connectors do not pass through managed-mcp.json; organization connector-tool controls govern that path.
Claude Cowork distributes skills, connectors, and sub-agents through plugins. Its safety guidance states that local MCP servers run on the computer with ordinary program permissions. Review those servers as executable dependencies, including their credentials and network access.
The MCP supply-chain attack surface is concrete. We demonstrated one exploit against Supabase's MCP integration where prompt injection through customer data leaked private SQL tables. The same class of attack applies to any MCP-enabled deployment. Match least-privilege controls to the actual server or connector path in each deployment.
Decision framework#
Consider a repository-focused Code pilot when:
- The workload is bounded by a code repository.
- You can validate the proxy and TLS-inspection path for each enabled tool.
- You need managed MCP allowlists, ConfigChange hooks, or a repository-scoped execution boundary.
- The workflow can leave optional browser and computer use disabled.
- You have constrained the enabled tools to the paths your team can monitor.
Use Cowork only after building a control plane when:
- The work suits Cowork's knowledge-work interface, files, connectors, and recurring tasks.
- Computer use is genuinely required and no MCP or API alternative exists.
- You have routed Claude Desktop, the Chrome bridge, code-VM egress, and local MCP servers through an on-device proxy or LLM gateway.
- You have enabled Compliance API capture and export Cowork OpenTelemetry to a controlled collector.
- You have mapped remaining evidence gaps and excluded PHI because Cowork is outside Anthropic's BAA.
Use both:
- Engineering team on Claude Code, in repos, with
managed-mcp.jsonenforced. - Operations, GTM, and general knowledge work on Claude Cowork, behind a proxy and policy layer.
Claude Code exposes managed controls for engineering deployments. Both products can have transcript coverage, and both need separate controls for enabled desktop actions. We laid out that path in How to Secure Claude Cowork.
Claude Cowork vs Claude Code FAQ
Four questions on the enterprise security delta between Claude Cowork and Claude Code.
- Is Claude Cowork suitable for HIPAA or other regulated workloads?
Keep PHI out of Cowork because Anthropic's BAA does not cover the feature. Other regulated workloads need a control-by-control assessment. The Compliance API now returns supported Cowork session transcripts, but it is retrospective evidence rather than runtime enforcement, and computer use still acts on the real desktop outside Cowork's code VM.
- Does Claude Code have a real sandbox?
Yes, for Bash subprocesses. Built-in file tools use the permission system, and optional computer use runs on the host desktop. Enabling the Bash sandbox does not isolate every action Claude Code can take.
- Can I use the same MCP server in both Claude Code and Claude Cowork?
Both support MCP, but check the server's transport, authentication, and supported client setup. Code has managed MCP configuration; its controls differ for servers and connectors delivered through different session types. Review the actual integration rather than assuming a configuration file governs every path.
- Which one is safer for an enterprise pilot today?
A repository-focused Code pilot can use managed MCP configuration, proxy controls, and Bash sandboxing. Keep optional browser and computer use out of the pilot unless the workload needs them. Both products need separate controls for enabled desktop actions; the product name alone does not establish a smaller security boundary.
Enterprise Solutions For Claude Cowork And Claude Code#
The enterprise solution stack differs by product, but both need a control plane outside the agent UI. General Analysis AIDR provides the AI Detection and Response layer across Claude Code and Claude Cowork by correlating prompts, file access, browser activity, MCP and plugin use, Bash commands, hooks, policy decisions, and downstream business actions into incidents, evidence, and response workflows.
For a Code deployment limited to repository work, the supporting stack may stay relatively narrow: Claude Code Enterprise for native policy, Cloudflare Gateway or Zscaler for traffic control, and Splunk or Microsoft Sentinel for audit evidence. When either product reaches browsers and host applications, add controls for those paths. Cowork deployments also need review of plugins, connectors, and scheduled tasks. That means the same GA AIDR layer should be paired with on-device proxying, browser-use and computer-use policy, plugin governance, connector scoping, endpoint telemetry, and scheduled-task review.
General Analysis can operate these layers together so security teams can compare both products in one evidence model, enforce risky-action controls without adding unnecessary latency, and keep the agent workflow useful while constraining its blast radius.
