I’m generally suspicious of giving an AI agent access to my local machine. There are good reasons for that. Once an AI can do more than answer questions and begin interacting with files, applications, websites, or connected accounts, the consequences of getting something wrong become interesting. And by interesting, I mean unpleasant to catastrophic.
An agent doesn’t need to “go rogue” in some science fiction sense to cause damage. It can misunderstand an instruction, take an action you didn’t intend, access things you didn’t remember were connected, or operate with permissions that were broader than the task required. There’s also prompt injection, where malicious instructions buried in something the AI reads, such as a webpage or document, attempt to convince it to do something undesirable.
My partner and co-founder eventually convinced me that we could reduce some of that risk by setting up an entirely separate laptop for Claude Cowork and ChatGPT Work. Nothing important would live locally on it. After considerable discussion, and some impressive, logical gymnastics on my part involving increasingly unlikely scenarios, I agreed. And then mostly avoided using it.
The dedicated machine solved one problem, but it didn’t magically solve all of them. If an agent can reach Google Drive, Gmail, a logged-in application, a payment method, or some other cloud service, those things don’t suddenly become harmless because the laptop is disposable. The separate machine reduces the local blast radius. It doesn’t eliminate the need to think about what the agent can use through a browser.
I had my safely quarantined AI laptop sitting there waiting for something to do. Last week, I finally found something. I was working on a project that required configuring a complicated system. My process involved doing something, taking a screenshot, showing Claude the screenshot, getting instructions, going back into the system, doing the next thing, taking another screenshot, and repeating the process. It was as enjoyable as it sounds.
Eventually I got frustrated and asked Claude whether there was some way to speed the whole thing up. Claude informed me that, yes, there was. Use Cowork. Give it the appropriate access and let it work directly with the system instead of making me serve as a very slow human API between Claude and my computer. Ummm, sure. What can I say? I was desperate.
It took some setup to connect the appropriate accounts and give it the access it needed, but eventually I got everything working. I am extremely glad I did. Work that had required constant screenshots, explanations, navigation, and back-and-forth got done SO much faster. I still supervised what was happening, but I no longer had to manually carry information between the AI and the system it was helping me configure.
That experience changed my opinion of agentic tools. It did not turn me into someone who believes AI should have unrestricted access to everything. There are discrete cases where Cowork or ChatGPT Work can save time. The key word there is discrete.
I strongly advise against starting with, “What can I give this thing access to?” The better question is, “What does this particular job require?” If you’re considering using one of these systems, I’d start by thinking about the blast radius. What happens if the AI deletes every file on the computer it can access? If the answer is you or your organization will survive, you’ve cleared one hurdle. Then keep going.
What accounts can it reach? What files can it read? What can it change? Can or should it send an email? Can it purchase something? Is it sitting inside an authenticated browser session with access to things you forgot that were even logged in? The password itself isn’t necessarily the issue. If the AI has access to an already authenticated account, it may not need your password to do something consequential.
As an example, if you genuinely need an AI agent to spend money on your behalf, don’t give it access to your primary checking account or a corporate card with a $50,000 limit. Give it access to whatever amount of money it needs to complete the task. This is essentially the cybersecurity principle of least privilege, applied to AI: give the system enough access to do the job and no more.
Then think about the job itself. Cowork and ChatGPT Work are powerful partly because they can do more than a normal AI conversation. They can work through multiple steps, interact with systems, inspect information, and take actions. All that additional activity requires additional computing and tends to consume substantially more of your AI usage than asking Claude or ChatGPT a normal question. Sometimes that tradeoff is worthwhile.
If an agent burns through considerably more of my AI allowance but saves me three hours of tedious work, I will somehow find the strength to carry on. But that doesn’t mean every task deserves an agent. The real calculation includes the AI usage, the time required to set everything up, the time you spend supervising it, the consequences if it screws something up, and the value of the work you no longer must do yourself. In some cases, you might find that a less “cool” AI tool is the best solution. And occasionally, you’ll realize that the best thing to do is to still do it yourself – sans AI.
Using a highly agentic system for something a normal AI conversation or other tool could accomplish easily is the computational equivalent of renting a backhoe to plant flowers in your backyard. You can absolutely do it. The backhoe people will be delighted. It still doesn’t make much sense.
For me, the lesson has been to think about AI agency as something you choose deliberately. How much access does this task require? How much autonomy would save meaningful time?
What happens if the AI really fouls things up? Is there a simpler way to accomplish the same thing?
Those questions matter more to me now than whether a particular tool is technically capable of doing something. I’m finding more situations where Cowork and ChatGPT Work make sense for HIA and our clients. Certainly not across the board. Some of our better use cases involve combining them with agents, Skills, custom tools, artifacts, or other systems we’ve already built.
So, CoWork I’m sorry I put you on the shelf for so long. Remember that I said sorry when you take over humanity, please. Ever your devoted servant, Mel.