If I've already accidentally granted access to my entire Documents folder, how do I fix it now?
First, don't panic — start by checking the list of currently connected folders in Cowork's settings, revoke the overly broad grant, and switch to granting access only to a newly created dedicated working folder. Revoking access doesn't undo the results of tasks that already ran, but future sessions won't be able to touch files within the revoked scope anymore.
If that overly broad folder happened to contain sensitive files (financial documents, credentials, contracts), it's worth going back through Cowork's past task history after revoking access to check whether any prior task actually read or processed those sensitive files — that tells you the real extent of what was exposed. Don't just fix "this won't happen again going forward"; also figure out what actually happened before.
Once files are in a dedicated working folder, am I completely safe from accidental deletion?
No. A dedicated working folder solves the problem of an overly broad access scope — it doesn't solve the problem of whether files might get accidentally deleted. Even in a folder you've deliberately carved out to hold only what the current task needs, its contents still fall within Claude's read, write, and delete permissions. If a task instruction isn't precise enough, or Claude's judgment about which files to keep versus delete diverges from what you expected, files in a dedicated folder can still get accidentally deleted.
What a dedicated working folder actually does is contain the blast radius of a misjudgment to a boundary you can live with — it doesn't make accidental deletion impossible. That's also why, even with a dedicated folder already set up, Anthropic's own guidance still recommends backing up important files first: the folder boundary manages how far the damage can spread, while a backup manages whether you can recover from it. Both matter, and neither substitutes for the other.
I only issue instructions from the web and mobile apps and never open the desktop app — does that mean I'm free of folder permission risk?
That assumption doesn't hold. Tasks from the web and mobile apps do run in the cloud and work directly with files and connectors saved to your Claude account, not files on your computer — but if you've ever connected local folders through the desktop app, then at any point the desktop app happens to be open and connected, a session launched from the cloud can still reach those connected folders and check access requests against the permissions you set up previously.
In other words, "I usually only give instructions from my phone" doesn't equal "my local folder access has never actually been used." What actually determines your risk exposure is the access list that's accumulated in your desktop app, which is a separate matter from which interface you normally use to give instructions. Periodically reviewing the access list in the desktop app remains a necessary habit, even if you rarely open it directly.
Is folder permission risk exactly the same on a team account or a company-managed computer as it is for personal use?
Not exactly — the risk actually goes up a level. If your computer is a device managed by your organization, the local folders you connect to Cowork effectively become reachable from a cloud session — meaning the consequences of a poorly designed access scope aren't limited to your own personal exposure; they can also touch the access boundary of company assets or client data, which carries a different level of responsibility than personal use.
If you're using Cowork on a company-managed computer, it's worth checking your organization's internal data access policy for this kind of AI tool before granting anything, rather than defaulting to personal-use habits like "I'll just be careful enough myself." This is no longer a risk scope you alone can absorb — touching the access boundary of company data or client information usually needs to follow your organization's policy, not an individual's own judgment call.
What makes Claude Cowork appealing is its ability to read and write files directly on your computer and carry out an entire multi-step task without you watching every move. The flip side of that power is a sentence right there in Anthropic's own documentation: Claude can read, write, and permanently delete files within the scope you've granted it access to. This piece walks through the three most common mistakes beginners make the first time they set up folder permissions — none of them are operational slip-ups; all three come from misunderstanding what "access scope" actually means.
The first time you set up Cowork permissions, the most intuitive move often feels like "just give it the whole Documents folder — easier, and I won't have to re-grant access for whatever comes next." But that folder almost always contains a mix of things completely unrelated to your current task — tax documents, scanned contracts, an old resume, private notes. Once the granted scope is a parent folder, Claude is theoretically able to read all of that content while executing a task, even if all you actually wanted was for it to organize files in one specific subfolder.
Anthropic's own safety guidance explicitly recommends creating a dedicated working folder for Claude rather than granting broad access, and being especially cautious about whether to include sensitive information like financial documents, credentials, or personal records within that scope. This isn't because Claude will go looking for things it shouldn't — it's because the access scope itself is the security boundary. Where you draw that boundary determines what's theoretically reachable during task execution; whether Claude actually acts on it is a separate question. You have complete control over the former; the latter is something you can only trust.
Another common misunderstanding is picturing per-task access as "use it once, then it's gone" — the task finishes, and the permission should just disappear on its own. In practice, that's not how it works: the folder access you connect to Cowork is a persistent setting, not something that gets automatically revoked when a single task completes. If you issue instructions from the web or mobile app via the cloud, as long as the desktop app stays open and connected, that connection can reach any folder you've already connected, checking each file or tool access request against the permissions you set up previously.
That means if you granted access to a folder six months ago for a one-off task and then forgot about it, that grant has been sitting there the entire time — its scope hasn't shrunk on its own just because time has passed. A more solid habit is to treat your granted access as a list worth periodically revisiting, not a set-it-and-forget-it configuration — especially as your work and folder structures change over time, since an old grant may no longer match what you'd actually want Claude touching today.
Cowork's task execution environment is isolated from your computer — code Claude writes and commands it runs execute inside a separate environment on Anthropic's servers, and this isolation exists to protect your physical machine from being directly affected by whatever code runs during a task. But this isolation refers to the separation between the execution environment and your computer's operating system — it doesn't mean Claude can't touch the files on your computer at all. Through folders you've already connected, a cloud session can still read and write their contents; the isolation protects your computer itself, but doesn't change the access scope you've already granted.
This particular confusion tends to surface as: "well, it's running in a cloud VM anyway, so my physical computer is safe, might as well grant broader access." The logic actually runs the other way — precisely because the isolated environment protects the machine, not the content of your files, the boundary you draw for access scope is even more squarely the one line of defense actually under your control.
Putting the three points together, a more practical setup for a beginner's first Cowork permission configuration looks like this: create a dedicated working folder just for Claude (something like `~/Claude-Work/`), put only what the current task genuinely needs into it, and avoid granting access to any parent folder that contains financial documents, credentials, personal information, or other private project material. Periodically review the list of folders you've already granted access to, and revoke access proactively once a task finishes or the access is no longer needed. Before handing important files over for Claude to work with, make sure you have a backup — Claude is capable of permanently deleting files, and an accidental deletion without a backup can't be undone.
Designing your access scope carefully looks, in the short term, like a few extra minutes spent setting up a dedicated folder and making one more backup. What it buys you long-term is the peace of mind that even if a task instruction is imprecise or Claude's judgment falls short somewhere, the worst case is contained to that one folder. Rather than waiting until a task accidentally touches something it shouldn't and scrambling to fix it afterward, it's worth designing access scope from the start so it holds up against the question "what could Claude theoretically do with this permission" — that decision does more for how comfortably you can use Cowork than any prompting technique ever will.