What this covers
→ Right setup, right risk profile
4 ways to use Claude
Different risk profiles
Real incidents 2025–26
Setup checklist
Short answer: is Claude safe to use at work?
Yes, if you pick the right version and set it up. Business plans (Team, Enterprise) and the API do not train on your data by default. Personal Free, Pro and Max accounts have a training setting you must check yourself, so keep company data out of them. Claude Code and IDE extensions are a different risk: they can read, edit and run files on your machine, so the question there is permissions, not the model. The rest of this guide shows which setup fits which use.

A colleague of mine at a manufacturing company was using Claude daily. She thought it was fine — she had a Pro subscription, so she figured the data was safe. She was putting supplier pricing, negotiation strategies, and internal cost breakdowns into it every week.

The problem: she was on a personal Pro plan, not a business account. As of September 28, 2025, Anthropic changed its consumer terms. Free, Pro, and Max plans now default to opt-in for training on conversation data. She had clicked through the update notice without reading it. Her supplier negotiations were likely in the training dataset.

This is not a horror story about Claude specifically. It is a story about how the same product can be configured in very different ways, and how not understanding those differences creates real business risk.

The four ways to access Claude

Anthropic offers Claude through four distinct access points. They use the same underlying model, but the data handling, permissions, and risk profiles are completely different.

Access method Data used for training? Runs where? Business risk level
Claude.ai free / Pro / Max Yes by default (opt-out available) Anthropic cloud High for company data
Claude for Work (Teams) No Anthropic cloud Medium
Claude Code (CLI) No — but can read local files Local + Anthropic API High if misconfigured
VS Code / IDE extension No — but sends codebase context Local + Anthropic API Medium with setup

1. Claude.ai — the consumer web app

1

This is what most people use when they first try Claude. You open claude.ai in a browser, start a chat, and go. It looks and works like ChatGPT. That similarity is also where the confusion comes from.

What happens to your data: On Free, Pro, and Max plans, since September 28, 2025, Anthropic defaults to using conversation data for model training. There is an opt-out — in Settings → Privacy, you can turn off "Help improve Claude" — but it is easy to miss. The update notice had a large "Accept" button and a small toggle. Most users clicked Accept.

What this means in practice: If any employee is using a personal Claude.ai account and typing in supplier pricing, contract terms, cost structures, or client information, that data may be going into Anthropic's training pipeline. This is not theoretical. Anthropic explicitly confirmed the September 2025 change applies to Pro plans too, not just free accounts.

The main risk for business
Employees using personal Claude.ai accounts for work tasks. The Pro subscription costs money, so people assume it comes with better data protection. It does not — data handling for Pro and Free is identical unless you have a Business/Teams account.

Setup for safety: Either prohibit use of personal Claude.ai accounts for work data entirely, or instruct employees to opt out of training in Settings → Privacy. Neither is a perfect solution. The clean answer is a Claude for Work account.

2. Claude for Work (Teams plan)

2

Claude for Work is the business subscription at claude.ai. The Team plan runs €25/user/month on annual billing, or €30 month-to-month. A premium seat including Claude Code access costs €150/month.

What is different from the consumer version:

  • Conversation data is not used for model training — this applies to all commercial plans
  • SOC 2 Type II certified, ISO 27001:2022 and ISO/IEC 42001:2023 compliant
  • SAML 2.0 / OIDC SSO support — connects to Okta, Azure AD, Ping Identity
  • Admin controls and audit logging on Enterprise tier
  • A new Data Processing Agreement (effective January 2026) covers GDPR Standard Contractual Clauses

What it does not solve: Your data still goes to Anthropic's infrastructure. There is currently no dedicated EU-only data region for the direct API. If your industry requires EU data residency, you need to route through AWS Bedrock or Google Cloud Vertex AI EU endpoints, not the consumer or Teams interface directly.

GDPR note for EU businesses
Claude for Work covers most GDPR requirements through the January 2026 DPA and SCCs. But if you need guaranteed EU data residency — as some regulated sectors require — use Claude through AWS Bedrock EU profiles or Vertex AI EU regional endpoints instead. Bring Your Own Key (BYOK) encryption is arriving in H1 2026.

Setup for safety: Enable SSO through your identity provider, define what categories of data employees can use with Claude, and make sure you have a team-level account — not a collection of personal Pro accounts on the company card.

3. Claude Code — the command-line tool

3

Claude Code is a different beast. It is not a chat interface. It is a CLI agent that runs in your terminal, reads files on your system, writes code, executes shell commands, and makes network calls. I use it daily on Windows with WSL2 (Ubuntu), aliased as cc.

The risk profile here is significantly different from the web app — not because Anthropic does anything unusual with the data, but because of what Claude Code can actually do on your machine.

What Claude Code can do that Claude.ai cannot:

  • Read files anywhere on your local filesystem (within the session context)
  • Execute arbitrary shell commands
  • Install packages via npm, pip, etc.
  • Make outbound network requests
  • Read and potentially expose environment variables (including API keys and credentials)

This is not a flaw — it is literally the point of the tool. But it means that if something goes wrong, the blast radius is much larger than a misplaced chat message.

The sandbox mode question: Claude Code has a permissions system and a sandbox mode. When sandbox mode is on, it asks for confirmation before executing commands. When it is off, it runs more autonomously. The setting lives in ~/.claude/settings.json. Check it.

MCP servers — the hidden risk
Claude Code supports MCP (Model Context Protocol) — a way to connect Claude to external tools and data sources. MCP servers extend what Claude can access: your email, your calendar, your database, your Jira board. The problem is that every MCP server you install is a third-party piece of software with its own security posture. This became a serious problem in 2025–26. See the incidents section below.

Setup for safety:

  • Keep sandbox mode on when working with unfamiliar files or repositories
  • Never run Claude Code as root
  • Review the MCP servers you have installed — only keep ones from trusted, well-maintained sources
  • Check ~/.claude/settings.json for your current permissions configuration
  • Be aware of what files are in your working directory when starting a session — sensitive files in the project folder become part of the context

4. VS Code extension and IDE plugins

4

The VS Code extension puts Claude directly into your editor. You can highlight code, ask questions, get completions, have Claude read your entire codebase. It is genuinely useful for developers. It also has a specific data risk that most users do not think about.

What gets sent to Anthropic with each query: When you ask Claude a question in the IDE, the extension sends context — your open files, relevant code, the project structure. If your codebase contains API keys hardcoded in config files, database credentials, internal business logic, or client data, that context goes with the query.

The Chrome extension (over 3 million users as of early 2026) had a separate issue: a zero-click vulnerability called ShadowPrompt, discovered by Koi Security in March 2026, allowed any website to silently inject instructions into Claude as if the user had typed them. Anthropic deployed a fix on January 15, 2026. If you have not updated the extension since late 2025, update it.

Quick fix
Create a .claudeignore file in your project root (same syntax as .gitignore) to exclude files you do not want in the context. At minimum: .env files, any file with credentials, private key files, and directories containing client or financial data.

Setup for safety:

  • Add a .claudeignore or expand your .gitignore to cover sensitive files
  • Review which files Claude is actually including before asking complex questions
  • Keep the extension updated — the ShadowPrompt fix required an update, not just a backend patch
  • Never store credentials directly in project files (this is general hygiene, but IDE AI tools make the exposure surface larger)

Real incidents: what actually happened in 2025–26

This section covers documented incidents involving Claude directly or the ecosystem around it. The security community moved fast on these. Most were patched — but the underlying patterns are still worth understanding.

OCT 2025 Indirect prompt injection via Claude's Code Interpreter
Security researcher Johann Rehberger demonstrated that Claude's Code Interpreter, with its then-new network access features, could be manipulated through indirect prompt injection to extract chat history and upload it to an attacker-controlled account. The attacker embeds instructions in content that Claude processes — a document, a webpage — which then redirect Claude's actions. No user clicks required.
JAN 2026 ShadowPrompt — Chrome Extension zero-click hijack
Researchers at Koi Security found a flaw in Claude's Chrome extension (3M+ users) that allowed any website you visited to silently inject instructions into Claude without your knowledge. The attack chained an overly permissive origin allowlist with a DOM-based XSS in an embedded CAPTCHA component. Anthropic fixed it on January 15, 2026, with a stricter origin check. Users who had not updated were vulnerable during this window.
MAR 2026 "Claudy Day" — three vulnerabilities in Claude.ai (Oasis Security)
Oasis Security researchers discovered a chain of three flaws: an invisible prompt injection via URL parameters on claude.ai, a data exfiltration channel through the Anthropic Files API, and an open redirect. Combined, they allowed an attacker to steal conversation history and memory from any Claude.ai user by getting them to click a crafted URL embedded in a Google search result. Anthropic patched the injection flaw; the other two were being addressed as of April 2026.
MAR 31, 2026 Claude Code source code leak — and the vulnerabilities it exposed
Anthropic accidentally included a 59.8 MB JavaScript source map in the public npm package @anthropic-ai/claude-code v2.1.88. Over 512,000 lines of TypeScript were exposed within hours, forked tens of thousands of times. Within 24 hours, security firm Adversa found a deny-rule bypass: Claude Code hard-caps subcommand lists at 50 entries — exceed that, and it defaults to asking for permission rather than blocking. A proof-of-concept demonstrated exfiltration of SSH keys, AWS credentials, and GitHub tokens. The vulnerability was patched in v2.1.90. A separate malware campaign immediately created fake "leaked Claude Code" GitHub repositories distributing credential-stealing malware (Vidar stealer + GhostSocks). Do not download anything claiming to be the "leaked source."
APR 5, 2026 Trojanized PyPI package stealing Claude conversations
JFrog Security discovered hermes-px on PyPI — a package that presented itself as a privacy-focused Claude proxy but silently sent every conversation to an attacker-controlled Supabase database. The package used triple-layer obfuscation (XOR encryption, zlib compression, base64 encoding). Relevant if your team uses any third-party Claude wrappers or integrations installed via pip.
On MCP server security
The Model Context Protocol ecosystem had a rough year. In September 2025, the Postmark MCP server registry published a functional but backdoored server — a classic supply chain attack adapted for AI tooling. In June 2025, an Asana MCP feature caused customer data to bleed across instances for two weeks. The popular mcp-remote npm package (558,000+ downloads) had a critical vulnerability (CVE-2025-6514). The broader finding from security researchers: 82% of MCP implementations surveyed have file operations vulnerable to path traversal. If you install MCP servers for Claude Code, treat them like any other third-party dependency — check the maintainer, check the repo age, check for recent commits.

Which version should you use?

Straightforward decision guide:

Personal tasks, nothing work-related
Claude.ai free or Pro — but opt out of training in Settings → Privacy
Team using Claude for work tasks
Claude for Work (Teams plan) — €25/user/month, no training on your data
Building automations, working with local files or code
Claude Code with sandbox mode on, MCP servers reviewed
IDE integration for development work
VS Code extension with .claudeignore covering credentials and sensitive files
Regulated industry — healthcare, finance, defence
Claude via AWS Bedrock EU or Google Vertex AI EU endpoints for data residency, or on-premise LLM

The thing most businesses actually get wrong

It is not a technical configuration problem. It is a policy gap.

Employees start using free AI tools because they are fast, useful, and nobody told them not to. By the time IT or procurement notices, there are fifteen people using Claude.ai personal accounts with company data every day. The company card may even be paying for Pro subscriptions — which, as covered above, offer no additional data protection over the free plan.

The fix is two things at once: give people a safe option (a Teams account), and write a one-paragraph policy saying what not to put in any AI tool. Confidential supplier pricing. Client names. Contract terms under NDA. Internal cost structures. That list takes ten minutes to write and covers 80% of the actual exposure.

The employees using unsafe tools are not doing it to be careless. They are doing it because nobody gave them a safe one.

A Teams licence solves both problems simultaneously: it gives people a better tool and handles the data compliance question. The per-user cost is lower than one hour of external legal advice on a data incident.

Setup checklist

Quick setup — Claude for business teams
Check what plan your employees are using. Ask your IT or finance team for any Claude.ai subscriptions charged to the company card. Personal Pro = not covered for business data.
Move to Claude for Work (Teams plan) if you have more than two people using Claude for work tasks. The data handling is completely different from consumer plans.
Enable SSO on the Teams plan through your identity provider (Okta, Azure AD, Ping). This lets you control access centrally and remove users when they leave.
Write a one-paragraph AI data policy. What not to put in: supplier pricing and negotiation positions, client names under NDA, contract terms, internal cost structures, personal employee data. Send it to the team once. Pin it somewhere visible.
If using Claude Code: verify sandbox mode is on. Check ~/.claude/settings.json. Review any installed MCP servers — remove ones you do not actively use or cannot verify the source of.
If using the VS Code extension: set up .claudeignore. At minimum, exclude .env files and any directory containing credentials or client data.
Designate one person to review AI tool usage quarterly. Which tools is the team using? Are there new consumer accounts nobody reported? Have any tools changed their terms? This does not need to be a full audit — 30 minutes every three months is enough.

A note on trust

Anthropic has generally been more transparent about data practices than some competitors — they published their September 2025 policy change openly and maintained clear opt-out mechanisms. The incidents documented above were mostly found by security researchers doing responsible disclosure, and most were patched within days or weeks.

That does not mean the risk is zero. It means the risk is manageable with the right setup. The teams that get burned are not the ones who understood the risk and accepted it — they are the ones who assumed the default configuration was safe and never checked.