Claude CoworkClaude Cowork · Pro, Max, Team and Enterprise plans
1
Curious builder0 XP earned · 300 to level 2
0 daysFinish a lesson to begin
Badge collection0 of 6 unlocked
21 small wins to finish your pathNext lesson →

Where the work actually happens

Most surprises in Cowork come from one thing: not knowing where the work is running. A few minutes here explains almost all of them.

By default a task runs in the cloud. Anthropic's documentation puts it plainly: the agent loop and the code run in an isolated, temporary sandbox on Anthropic-managed infrastructure, and each session gets its own, created when the session starts and destroyed when it ends.

So how does it read a file on your laptop

It asks your machine for it. When a cloud session needs something local, the request goes through the Claude Desktop app on that device over a connection Anthropic brokers, and it can only reach folders you have connected on the desktop.

A local file, reaching a cloud session
You connect a folder. On the desktop app. Nothing outside it is reachable.Step 1 of 4

Two consequences worth remembering. If the desktop app is closed, a cloud session cannot reach your local files, and if you connected only one folder, that is genuinely all it can see.

What the sandbox can reach on the network

Less than you might assume, and deliberately. All traffic leaving the sandbox passes through a proxy the sandbox cannot reconfigure or bypass, only allow-listed destinations are reachable, and it cannot reach private, internal, link-local or cloud-metadata addresses.

That is why a task cannot fetch something from your company intranet by itself. It is not a bug to work around, it is the boundary doing its job.

Connectors are handled elsewhere

When a task uses a connector, the tokens never enter the sandbox. Those calls are made on the server side. So a task that reads your calendar is not holding your calendar credentials, which is the property you want if anything it reads ever turns out to be hostile. Lesson 16 is about exactly that.

What a task can reach, and how
Its own sandboxtemporaryempty at the startgone when the session endsYour filesonly folders you connectedbrokered through the desktop appnothing if the app is closedConnected appscalled on the server sidetokens never enter the sandboxThe networkthrough a proxy it cannot bypassallow-listed destinations onlyno private or internal addressesA running task

The local option

On the desktop there is a second mode where the agent loop runs on your own device and code execution happens in a virtual machine isolated from your operating system by the platform's hypervisor. Cloud is the default and the one to learn first, but knowing the other exists explains why some behaviour differs between machines.

One sentence version
The single sentence to keep: the sandbox is temporary, it starts empty, it dies with the session, and everything it reaches from your world was either connected by you or brokered through your desktop app.
Try it yourself
  • Open the desktop app and look at exactly which folders are connected. Most people have connected more than they remember.
  • Ask a task to read something in a folder you have not connected, and read what it says.
PreviousYour first task

Slow is fine. Stopping is the only problem.