Claude Code & Cowork: Enterprise Security Review

Anthropic's enterprise push has produced the most security-forward agent stack of the major labs — and, in the same July week, one of the clearest first-party demonstrations of why that stack still needs governance around it: at Black Hat USA 2026, Roblox's engineers presented a real credential-exfiltration incident involving Claude Code, along with the multi-layer sandbox they built to contain coding agents afterward. Both halves of that sentence are the review: Claude's enterprise controls are genuinely good, and genuinely not enough on their own.

This is the security review of the two products your teams are asking about — Claude Code (the coding agent) and Claude Cowork (the workspace agent) — what Anthropic ships, what the incident record teaches, and the hardening checklist for both.

Last verified: August 6, 2026. Several July features are new and evolving; reverify against Anthropic's current documentation.

What you're actually approving

Claude Code runs in terminals and IDEs with repository-scale context: it reads your codebase, executes commands, and — via MCP — reaches file systems, databases, and internal APIs. Claude Cowork brings the same agentic model to knowledge work: connected apps, files, multi-step autonomous tasks, with Microsoft 365 write capabilities added in July. The common denominator: both hold real credentials and act on real systems, mostly from endpoints your network tools cannot see into.

What Anthropic ships for the enterprise (a genuinely strong list)

Inference hooks (beta, August 5) — real-time policy inspection inside Claude across Chat, Claude Code, Cowork, and tool responses. First-party inline enforcement as a platform primitive is a category first, and it is a direct integration surface for governance vendors — including us.
Compliance API — programmatic access to conversations, files, and audit events for your tooling.
MCP spec 2026-07-28 adoption — hardened OAuth-based authorization, a 950+ server connector directory with an observability dashboard, and previewed enterprise-managed auth.
Self-serve HIPAA configuration (July) and FedRAMP High availability for Cowork — regulated-industry paths most agent products lack.
Published CISO guidance built on four questions — untrusted content, available actions, blast radius, observability — which is, frankly, the right frame.

What the incident record teaches anyway

1. The Roblox lesson: credentials are the blast radius

A coding agent with repo access is also an agent with access to everything in the repo and its environment — .env files, cloud keys, tokens in config. Roblox's answer was containment architecture: layered sandboxes around what the agent can reach. The generalizable controls: scan context for secrets before it uploads (60+ secret types is our coverage), scope agent credentials per-task rather than per-developer, and rotate anything an agent has ever read.

2. MCP is the power and the exposure

A 950-server directory makes MCP allowlisting an operational necessity, not a nicety — tool poisoning via description payloads was Microsoft's June warning, and skill/MCP files as a malware channel was a Black Hat talk two days ago. Every Claude Code deployment inherits whatever MCP servers developers wire up; most organizations cannot list theirs.

3. Memory and long-horizon tasks extend the injection window

Cowork's multi-step autonomy meets the same cross-turn persistence research shown at Black Hat: injected instructions that survive in context and memory beyond the turn that planted them. Per-turn input filtering is not the defense; action-level policy is.

4. First-party hooks are not third-party assurance

Inference hooks are excellent — and they are Anthropic's hooks, inside Anthropic's runtime, covering Anthropic's products. Your estate also runs Copilot, ChatGPT, and homegrown agents; your auditors want evidence that does not depend on the audited platform; and your endpoint blind spot (local MCP servers, other tools) is outside any one vendor's hooks by definition. The architecture that works: use the hooks as an enforcement point, keep policy and evidence in an independent layer that spans the estate.

Hardening checklist

Deploy Claude Code with secret-scanning on context before rollout, not after the first key leaks.
Stand up an MCP allowlist and a lightweight internal registration path; sweep endpoints for unsanctioned servers quarterly.
Scope Cowork's M365 write access per-group; start read-only, expand per workflow.
Wire the Compliance API / inference hooks into your DLP and SIEM — the primitives exist; unused primitives are gaps.
Give agents distinct identities and credentials — the Okta finding that agents overwhelmingly authenticate as humans is the anti-pattern to design against.
Log and review agent actions weekly during pilot: tool calls, destinations, and anything following untrusted content.
If PHI is in scope, execute the BAA and confirm the HIPAA configuration covers the specific products in use.

Verdict

Claude Code and Cowork are approvable — Anthropic has done more of the enterprise homework than any competitor, and the July–August releases (hooks, managed auth, HIPAA path) close real gaps. But the Roblox incident is the honest coda: a security-forward vendor, a sophisticated customer, and a credential exfiltration anyway. The controls that would have caught it — secret scanning at the boundary, scoped agent credentials, independent action logging — are yours to run, not the model vendor's. Approve the products; own the governance.

FAQ

Is Claude Code safe for our developers?

With secret-scanning on outbound context, scoped credentials, and MCP allowlisting — yes, and the productivity case is real. Without those three, you are trusting every repository's hygiene and every developer's dotfiles, which is what the incident record argues against.

Do Anthropic's inference hooks replace third-party DLP?

They replace a slice of it for Claude traffic, and we say that plainly. What they cannot provide: one policy across Claude + Copilot + ChatGPT + custom agents, endpoint discovery of what is running, or platform-independent audit evidence. Hooks are an enforcement point; governance is the layer above.

Claude Cowork vs ChatGPT Work — which is safer?

Anthropic currently ships more security surface (hooks, compliance API, FedRAMP path); OpenAI ships strong admin controls (preauthorization, scoping). The honest answer: the deployment posture you run matters more than the vendor gap — and most enterprises will end up running both, which is an argument for governance that spans them. See our ChatGPT Work review for the other half.

What is the single highest-leverage control?

Secret scanning on agent context before it leaves the device. It is cheap, invisible to developers until it fires, and it directly addresses the failure mode that made the news.

Sources: Black Hat USA 2026 — Roblox "Caging the Agent" and related briefings · Anthropic product announcements July–August 2026 (inference hooks, MCP spec 2026-07-28 adoption, HIPAA configuration) per Anthropic's newsroom and release notes · MCP specification 2026-07-28 · Microsoft MCP tool-poisoning warning (June 2026) · Okta Enterprise AI Index (July 2026).

Claude Cowork and Claude Code: The Enterprise Security Review