How Cowork keeps things safe

This page explains how Cowork protects credentials and network traffic, local actions, and data left on the device when it runs an agent on your PC.

Overall flow

[Inside the PC]                                                   [Hane Platform]
Bundled harness ──model calls──▶ Cowork relay ──model credential──▶ Model Gateway
     │          (per-run credential)
     └──local tools (MCP)──▶ Cowork core ──checks policy──▶ files, Chrome, computer use
            (per-run credential)    │
                                    └──access token──▶ organization policy, model sessions

The only credentials the harness holds are per-run credentials that work only inside the PC. Neither the Platform access token nor the model credential is passed to the harness.

Credentials

Credential	Where it lives	Handling
Platform access token	Only in the Cowork core’s memory	Never saved to history or files. Never passed to the harness or the Chrome extension
Model credential	Only in the Cowork core’s memory	Bound to the user, organization, project, and environment, and valid for 5 minutes. Refreshed before it expires
Relay and tool endpoint credentials	The harness’s environment variables	Generated randomly for each run and unusable once the run ends

When work completes, is stopped, or fails, Cowork revokes the Platform model session. Calls after revocation are rejected.

Model traffic

• The harness sends requests to a loopback (127.0.0.1) relay that Cowork opens for each run.
• Cowork forwards the requests to the Model Gateway of the connected Platform. The destination is fixed to the connected Platform and is never switched to another host based on an API response.
• API keys for upstream model providers stay inside Platform and are never given to the device.

Local tools

Local tools are provided over MCP on the same loopback server.

• Requests with an Origin header (requests from web pages), a host name other than 127.0.0.1:<port>, or the wrong credential are rejected.
• The port and credential are recreated for each run and closed when the run ends.
• Each time a tool is used, Cowork decides using an organization policy read within the last 5 seconds. If the policy cannot be read, the action is treated as denied.
• File tools handle only the work folder and do not follow links out of it.

See Confirmations and organization policy for details.

Running the harness

• The shell, file, and web tools built into the harness are offered only for the capabilities the organization allows (Confirmations and organization policy). If Cowork detects that a tool that is not offered ran, it stops the work.
• On macOS, the harness runs in the OS sandbox, which blocks what the organization denies. If External transfer is denied, it blocks network access other than the loopback relay. If Work-folder files is denied, it blocks writes outside the per-conversation work area and reads of your home directory.
• The harness keeps its settings and records in the per-conversation work area and does not load your own opencode or Claude Code settings and instructions.
• The request text is passed on standard input, never on the command line.
• When you stop the work, the connection drops, or the harness exits abnormally, Cowork terminates the harness together with the processes it started.
• The harness is a fixed version bundled with Cowork, and its hash is checked at build time. Nothing extra is downloaded on the user’s PC.

Caution

Windows does not yet have an OS restriction equivalent to the macOS sandbox. Built-in tools are therefore not offered on Windows, and protection relies on Cowork’s tools checking the organization policy.

Chrome extension

• The extension never receives Platform credentials.
• The extension talks to Cowork only inside the PC and authenticates with a secret regenerated every time Cowork starts.
• Connecting alone does not collect tab contents or history. Only tabs you share are handled.
• Page text excludes hidden text and input field values, including passwords.

Data left on the device

Cowork saves the following in its app data directory.

What	Contents
Conversation history	Requests, replies, and progress. Deleted when you delete the conversation
Harness records	Includes requests, replies, and tool results. Deleted when you delete the conversation
Attachment copies	Attachments waiting to be sent. On macOS, saved with owner-only permissions (0600)
Drafts	Text and references to attachments
Work groups	Name, work folder location, instructions, and memos. Deleted when you delete the work group

Credentials, captured screen images, and window permissions are not saved. Because conversation text is stored, assume disk encryption on the device.

Next steps

AdministrationOrganization policy and rollout considerations

Platform securityHow Hane Platform as a whole is protected