AI agents are moving beyond answering questions.

They are increasingly being given permission to read, create, modify, and delete files. That changes the risk.

Claude Cowork is a useful example. Anthropic explicitly states that Cowork can read, write, and permanently delete files in connected folders. Anthropic also acknowledges that write tools carry greater risk because Claude can make mistakes, and recommends dedicated working folders, backups, and increased human oversight for high-stakes work.

That guidance matters because public reports in Anthropic's own Claude Code repository document file-integrity problems involving Cowork, including Windows and OneDrive scenarios.

One report, GitHub issue #53940, describes Cowork's Edit and Write tools silently truncating files on Windows. The report includes controlled reproductions and describes situations where the tool reported success even though content had been lost. The issue is specifically labeled as a Windows Cowork bug.

Another report, GitHub issue #62140, describes a Windows and OneDrive Files-On-Demand scenario in which Cowork allegedly operates against a local placeholder rather than the complete cloud file. The reported result is potentially serious: an incomplete representation can be written back over the full file, resulting in silent data loss.

These are bug reports, not evidence that every Cowork user will experience corruption. But that distinction does not make the underlying enterprise risk insignificant.

Windows and Cloud Synchronization Add Complexity

Modern Windows environments increasingly combine local applications with cloud-backed storage. A file displayed in Windows File Explorer may involve local storage, cached content, synchronization state, or a cloud-backed representation.

Cowork introduces another layer.

Anthropic's current architecture documentation distinguishes between remote and local Cowork execution. Remote Cowork sessions run on Anthropic's infrastructure and can reach local files through the Claude Desktop application. Existing local desktop sessions can run the agent loop on the device, while code execution operates inside an isolated virtual machine. On Windows, that VM uses Hyper-V.

The isolation is useful, but it does not eliminate the risk created by authorized file access. Anthropic specifically notes that isolation limits where Claude's code runs, but does not limit what Claude can read or do through permissions that have been granted.

This means organizations need to evaluate the entire chain: AI agent, permissions, filesystem, synchronization layer, application, and system of record. A failure anywhere in that chain can affect the final result.

This Is Bigger Than Claude

The real issue is not whether Claude is better or worse than another AI product. It is the emergence of AI with operational write access.

The same governance questions apply to any agent that can modify documents, spreadsheets, source code, databases, CRM records, cloud storage, financial systems, or production environments.

Traditional AI governance has focused heavily on privacy, hallucinations, bias, cybersecurity, and regulatory compliance. Agentic AI adds another category: data integrity. If an AI system can change the underlying information, organizations need controls for what happens when that change is wrong.

Treat AI Write Access as a Privileged Capability

The answer is not necessarily to prohibit AI agents. It is to govern them more like privileged software.

1. Use dedicated AI workspaces.
Do not give an agent unrestricted access to an entire Documents folder. Anthropic itself recommends creating a dedicated working folder and being selective about what files Claude can access.

2. Protect the original.
Use version history, backups, snapshots, or controlled working copies for important information. The AI should not become the only path to the organization's last known-good version.

3. Apply least privilege.
If an agent only needs to read information, it should not automatically receive write access. If it needs to modify a working document, that does not necessarily mean it should be able to delete files or access unrelated directories.

4. Verify important writes independently.
Do not rely solely on the same agent to confirm that its own write succeeded. For higher-risk files, verification can include file-size checks, structural validation, formula checks, parsing, automated tests, or human review. The appropriate control should match the consequence of failure.

5. Understand synchronization.
OneDrive and other cloud-storage systems should be part of the AI risk assessment. Organizations need to understand how cloud-only files, local caching, synchronization, version history, and conflict resolution interact with AI tools that read and write files. The OneDrive Files-On-Demand report demonstrates why this matters.

6. Monitor agent activity.
Organizations need visibility into what their agents are doing. Anthropic currently states that Cowork activity is not captured in audit logs, the Compliance API, or data exports, although Team and Enterprise customers can stream Cowork events through OpenTelemetry. That should be considered during enterprise deployment and risk assessment.

The Bottom Line

Claude Cowork is not the story. The larger story is what happens when AI crosses the boundary from generating information to changing the environment in which that information lives.

Publicly reported Cowork bugs involving file truncation, Windows, and OneDrive provide a useful warning. Anthropic's own documentation reinforces the need for selective access, backups, appropriate oversight, and monitoring.

The lesson for enterprises is straightforward: do not treat AI write access as a convenience feature. Treat it as a privileged operational capability.

Because once an AI can modify the data, AI governance is no longer just about what the model says. It is about what the model does. And when it does something wrong, the organization needs to know: What changed? How do we know? Can we recover?

That is where responsible agentic AI begins.

Sources & Further Reading

  • Anthropic, "Use Claude Cowork safely": official guidance covering Cowork's file access, write and delete capabilities, dedicated working folders, backups, human oversight, and monitoring.
  • Anthropic, "Claude Cowork architecture overview": official documentation covering remote and local execution, Windows virtualization, connected-folder access, permissions, and current audit and observability limitations.
  • Anthropic, "Use Claude Cowork on web, desktop, and mobile": official documentation describing the current Cowork experience across platforms and the role of the Claude Desktop application in local file access.
  • Anthropic Claude Code GitHub Issue #53940: a public Windows Cowork bug report documenting reported silent file truncation involving Edit and Write tools.
  • Anthropic Claude Code GitHub Issue #62140: a public Windows and OneDrive Files-On-Demand bug report documenting a reported silent data-loss scenario.

Disclosure: This article is an independent North Velocity Group analysis of publicly available technology documentation, reported software issues, and other sources. It is not a statement that any particular product or technology is universally unsafe, and it is not legal, cybersecurity, or technical assurance advice. North Velocity Group is not affiliated with or endorsed by Anthropic.