The hidden security risks of Claude's autonomous AI agents
Updated: 1 day ago
The main security risk of Claude's autonomous AI capabilities is inherited access. An AI agent may reach sensitive information through files, applications and integrations already available to an employee, potentially accessing more information than the task requires.
For UK alternative investment firms, including hedge funds, private equity and family offices, this creates concerns around confidential client information, material non-public information (MNPI) and regulatory oversight.
In September 2026, Anthropic began merging Claude Cowork and chat into one Claude experience, while retaining separate Cowork functionality for some Team and Enterprise organisations.
Alternit One examined these risks during its Secure Claude Deployment workshop at the With Intelligence Hedge Fund COO Summit in September 2026. This article explains how inherited access creates security gaps and which controls financial firms should review.
Why do autonomous AI agents create additional security risks?
Autonomous AI agents can complete multi-step tasks across files and connected applications, including reading documents, updating information and preparing communications.
Risks increase when an agent has access to more information or tools than its assigned task requires.
According to IBM's 2025 Cost of a Data Breach Report, organisations with high levels of shadow AI experienced average breach costs $670,000 higher than organisations with little or no shadow AI.
For investment firms handling confidential research, client records and trading information, controlling agent access is particularly important.
What can Claude Cowork access?
Claude's autonomous capabilities can work with files, folders and connected services that the user has authorised. The exact access depends on the integrations, permissions and deployment configuration.
Access may include:
Local or cloud-hosted files made available to the task.
Connected applications such as email and document management systems.
Tools and desktop integrations with permission to perform actions.
Information accessible through the signed-in employee's account.
An employee might authorise an agent to organise a project folder or prepare a report. However, existing connectors or desktop extensions may give the agent access to additional information or systems.
Alternit One therefore recommends reviewing both the agent's permissions and the access already held by the employee.
Can Claude Cowork bypass access restrictions?
Overlapping connectors can create unintended access paths when an AI agent has permissions through more than one integration.
Alternit One's workshop illustrates this risk with a read-only example.
Imagine a firm's IT team configures a connector to prevent changes to client records. An employee also has another integration with broader permissions, perhaps configured months earlier for a different purpose.
If the AI agent can use that second integration, the intended read-only restriction may not protect the same records through every access path.
This scenario concerns overlapping permissions and integrations. It does not mean Claude can automatically override a technically enforced read-only permission.
Potential consequences include:
Material non-public information accessed during an unrelated task
Restricted files copied into shared or less protected folders
Client records changed through an unintended integration
Sensitive information transmitted to an external service
Financial firms should review every route through which an agent can reach sensitive data, including local connectors and existing employee permissions.
Which Claude Cowork settings should financial firms review?
Alternit One recommends disabling three automatic approval settings by default to maintain
human oversight of consequential actions.
Setting | Alternit One's recommendation |
Act without asking | Disabled |
Always allow for connector tools | Disabled |
Cowork Auto mode | Disabled |
The setting names should be checked against the current Claude interface, as controls may change between versions and subscription plans.
Anthropic's Team and Enterprise Cowork guidance describes organisation-level controls for approval modes and connector tools.
How should firms restrict an agent's workspace?
Autonomous tasks should have access only to the information and systems required to complete their assigned work.
Control area | Alternit One's recommended safeguard |
Files and folders | Restrict the workspace to defined, approved folders |
Connected applications | Review connector permissions and remove unnecessary access |
Network access | Limit outbound connections to an approved host allowlist |
Sensitive actions | Disable unnecessary tools or require individual approval |
Local integrations | Restrict unapproved desktop extensions and local MCP servers |
These safeguards reflect Alternit One's workshop recommendations for workspace containment and human oversight.
They help limit the information an agent can access and reduce the potential impact of unintended actions.
How can firms audit what Claude's AI agents do?
Financial firms should establish suitable records of autonomous AI activity before deploying agents in sensitive workflows.
If an AI agent modifies a file, retrieves client information or sends data through a connected application, the firm needs sufficient records to investigate what happened.
Relevant records include the user responsible for the task, tools accessed, actions performed and approval decisions.
Anthropic documents OpenTelemetry monitoring for Claude Cowork for Team and Enterprise plans. It can send activity events to an organisation's monitoring tools, although the available information depends on the configuration and supported event types.
OpenTelemetry monitoring does not replace compliance audit logging. Firms should review their monitoring coverage and record-retention requirements before relying on it for regulatory investigations.
A useful test is whether the business could explain what an agent accessed, changed or transmitted if a regulator or client requested an incident report.
How do these risks relate to FCA requirements?
Financial firms remain responsible for managing technology risks and maintaining suitable governance over their operations.
The FCA's Senior Managers and Certification Regime (SM&CR) and Systems and Controls requirements (SYSC) establish accountability and governance expectations for regulated firms.
The Market Abuse Regulation (MAR) is also relevant to investment firms handling inside information. AI tools that can access confidential trading or investment information need suitable access and sharing controls to reduce the risk of unauthorised disclosure.
Where applicable, FCA operational resilience requirements also require firms to understand and manage disruptions affecting important business services.
Autonomous AI tools introduce additional operational risks when they interact with sensitive information or critical systems. Firms should include those risks in their existing security, access management and incident response processes.
How can Alternit One help assess Claude security risks?
Alternit One helps alternative investment firms review their Claude deployment, identify access risks and establish controls for autonomous AI tasks.
Its Secure Claude Deployment framework examines organisation-wide settings, Claude Code, desktop integrations and Cowork capabilities, with particular attention to inherited permissions, human oversight and auditability.
For the broader security framework and regulatory considerations, read How UK financial firms can use Claude AI securely.
Contact Alternit One to discuss a Claude security configuration review for your organisation.
