Category: AI Governance | Reading time: 9 minutes

A practice manager at a 45-fee-earner law firm approves Claude in Chrome for the corporate team.

The reasoning is sound. The firm already pays for Claude. The extension sits in the browser staff already use. The pilot request arrives with a short business case about contract review turnaround.

Each fee earner sees a screen headed "Before you start". Claude can take actions in your browser on your behalf. Claude can take screenshots when responding. Malicious actors can hide instructions in websites, emails and documents that trick AI into taking harmful actions.

Everyone clicks "I understand". Nobody clicks "Learn more".

Six weeks later the firm cannot answer any of these:

Nothing went wrong. That is not the same as the control environment working.

The obvious defence is that staff read the warning and accepted the risk. Three bullets, one click, informed consent.

It fails for a specific reason rather than a general one. The warning screen is a summary. The documentation behind it is not, and the documentation behind it is considerably more useful.

It is also more useful than most firms expect, because Anthropic does not stop at "be careful". It publishes the mechanism.

This is the sentence worth taking to your next governance meeting.

Anthropic states that for prompt injection attacks to be successful, two things must be true at the same time: Claude can read information outside your trusted boundary, and Claude can perform actions that could compromise the user. If one of those two conditions is not true, prompt injection attacks become more difficult.¹

Read that as a control design instruction, because that is what it is.

You are not going to eliminate condition one. Web pages, client emails and inbound documents are the job. Untrusted content is what a law firm reads all day.

So condition two is where the decision sits, and condition two is entirely yours.

Anthropic frames the whole risk the same way: when something goes wrong, the impact depends almost entirely on what Claude can read and see, and what Claude is allowed to do.¹

That is a permissions question. Your firm already knows how to answer permissions questions. It has been answering them about people for twenty years.

Anthropic divides tools into two groups. Read tools let Claude access and read content, such as reading an email inbox or taking screenshots. Write tools let Claude perform actions, such as creating a calendar invite, deleting a file, running a command, or clicking on the screen. Write tools inherently carry more risk because they can result in undesired actions.¹

The important thing for a regulated firm is how many routes exist to a write tool.

Three details from the documentation change how that diagram behaves in practice, and none of them is on the warning screen.

Isolation is not containment. Cowork sessions run in an isolated temporary environment on Anthropic's servers. Anthropic then says the quiet part directly: isolation limits where Claude's code runs, and it does not limit what Claude reads or does.¹ A firm reassured by "it runs in the cloud" has misread what the cloud is protecting.

Computer use sits outside the permission checks. Anthropic advises particular caution with computer use because Claude clicks, types and navigates the screen directly, without the permission checks that gate other Cowork tools, and because computer use has no sandbox between Claude and what is on the screen.¹

Permissions leak sideways. This is the one to sit with. Anthropic states that although Claude can only use apps you have given it permission to use, if it clicks a link in one app, that link will open, even if you have not given Claude permission to access that app.¹

So the honest answer to "we restricted it to three applications" is that you restricted where it starts.

Anthropic is not being careless, and it is worth saying so plainly.

For Claude in Chrome there are two classifiers, one screening incoming content for injection attempts and one checking every action before it runs, plus model training against malicious instructions, site blocklists, action confirmations for higher-risk steps and ongoing red teaming.² Cowork adds deletion protection requiring explicit permission before any file is permanently deleted.¹

Anthropic also publishes a figure. Its current configuration reduces attack success rates to less than 0.08% against internal testing that combines known effective attack techniques, with Claude Opus 4.8 showing significantly stronger prompt injection robustness than previous models.²

That number will be quoted in vendor decks all year, usually without the two qualifiers sitting in the same sentence.

The first is the model. The figure describes one named model in one configuration.

The second is the test set. The measurement is against attack techniques already known. Anthropic then says the risk is not zero, that novel attacks may emerge its evaluations did not cover, and that a successful one could lead to outcomes like data exfiltration.²

So 0.08% means a well-resourced vendor tested its current system against the attacks it knows about and drove the observed rate very low. That is good engineering. It is not a statement about attacks nobody has published yet, and Anthropic does not claim it is.

Which returns you to condition two. If you cannot drive the probability to zero, you reduce what a success reaches.

This distinction is about to matter in every AI conversation your firm has.

If someone tells you the agent has a human approval step, the useful question is not whether the feature is on. It is whether the protected action can complete without it.

If someone tells you permissions are restricted, the question is whether the prohibited resource is reachable another way. You already have the vendor's answer to that one: a link clicked in a permitted app opens regardless.¹

If someone tells you the agent only reads approved documents, the question is what happens when an approved document contains instructions addressed to the agent.

If someone tells you there is a human in the loop, the question is where, exactly, that human is required to intervene.

There is a live example in the product. Anthropic offers three modes. In "Manually approve" Claude asks before each action. In "Automatically approve" Claude reviews each action for safety before running it and blocks what it judges unsafe. In "Skip all approvals", in Anthropic's own words, nothing checks its actions.¹ Automatically approve is the default for the Cowork side panel.²

A firm describing its deployment as human-in-the-loop, without checking which mode is live, is describing a policy. The configuration may be that the agent proceeds on its own judgement unless its own safety system intervenes. Those are different control models, and only one of them puts a person in the path.

Nobody should have to discover which one is running during an incident review.

Which permission mode is actually live? Not what the policy says, and not what the pilot owner remembers approving. Open it and look. Manual, Auto or Skip. Then find out who chose it.

What can it actually reach? Write the real inventory, not the intended one:

Two things make this list longer than people expect. Plugins bundle skills, connectors and sub-agents into one package, so installing one can significantly expand Claude's scope of action.¹ And with the Excel and PowerPoint add-ins, data can move between applications without anyone directing the transfer.¹

What evidence could you produce in eighteen months? A client asks whether the AI touched their matter. Can you identify the session, the files, the pages, the actions, the approvals and the user? Team and Enterprise owners can stream Cowork events to SIEM and observability tooling through OpenTelemetry.¹ If the platform can produce the evidence and nobody configured it, that is a governance decision the firm made by default.

I am describing what Anthropic documents, not how the product behaves in your tenant. A vendor help page is not an assurance report, including when the vendor is unusually candid, and it is unusually candid here.

Nothing above is a regulatory requirement. No FCA or SRA rule names browser agents. What exists are the obligations you already hold on client data, supervision, confidentiality and record-keeping, applied to a tool that can now click things. Whether your arrangements meet them is a question for your compliance function and your insurer, not for a newsletter.

This is also moving underneath us. The Cowork safety article was updated the day I read it, and it now carries a notice that Cowork and chat are becoming one product, rolling out gradually by plan.¹ Check the current version before relying on any specific configuration detail above.

At AI Mindset we are developing the SAFE™ Agent Governance and Assurance methodology around the gap between the two conditions: repeatable evaluation covering grounding, permissions, tool boundaries, approval gates, escalation and injection resistance.

Governance says what should happen. Assurance produces evidence about what did.

The interesting thing about Anthropic's documentation is not that it admits risk. Every serious vendor does that now.

It is that Anthropic hands you the control design. Two conditions, one of which you own outright. Reduce what the agent is allowed to do and you reduce what any failure can reach, whether the failure is an attack, a misread instruction or a model having a bad day.

That is not an AI problem. It is least privilege, which your firm has applied to people since before any of this existed.

Your staff are authenticated to the document management system, the practice management system and the client inbox. You approved an agent that works inside that session.

What is it allowed to do, and could you prove the controls would stop it?

This article is general guidance, not legal advice. Whether a specific AI deployment meets your firm's regulatory obligations depends on your permissions, your client data, your supervision arrangements and your professional rules. That is a question for your compliance function and legal counsel.