Author(s): Rick Hightower

Originally published on Towards AI.

Part 4: An agent that can read your files, drive your apps, and act on your behalf needs a different kind of trust. Here is how Cowork’s safety model works, and the habits that do most of the protecting.

Every previous article has been about giving Cowork more power. It reads your files, runs code, drives your browser, clicks through your apps, and pulls from your connected tools. That power is the entire point. It is also exactly why this article exists.

The article frames agent safety as “different trust” from chat: a chatbot can be wrong, but an agent can take harmful actions. It explains Cowork’s key permission model (ask before acting vs. act without asking), emphasizing that the default should be asking and that faster “act without asking” use requires well-scoped tasks, trusted files/sites/tools, and close supervision. A core protection never changes—permanent deletion always requires an explicit permission prompt. The piece then describes layered internal defenses (malicious instruction refusal, content scanning, per-app permission prompts with default blocklists, and code isolation in a VM), and clarifies why no system is perfect due to the non-zero chance of attack. It introduces prompt injection in plain language and connects it to why restrictions like trusted browsing and supervision matter. Finally, it outlines practical habits for safer delegation (limit and isolate file access, monitor for scope drift, restrict web/computer access, vet plugins/MCPs, be cautious with scheduled tasks) and concludes with an analogy: grow trust gradually within limits rather than operating from fear.

Read the full blog for free on Medium.

Join thousands of data leaders on the AI newsletter. Join over 80,000 subscribers and keep up to date with the latest developments in AI. From research to projects and ideas. If you are building an AI startup, an AI-related product, or a service, we invite you to consider becoming a sponsor.

Published via Towards AI