Yes—Claude Cowork can delete your files within the folder(s) you explicitly share, but it is designed to require explicit user permission before permanent deletion. In other words, deletion is possible, but it is not meant to happen silently or “by accident” without you approving a prompt. The correct way to think about this is the same way you’d think about running a bulk file script: if a tool can write to your filesystem, it can potentially perform destructive actions. Cowork adds guardrails (permission prompts) but you should still act as if deletion is in the capability set and plan accordingly.
From a safe-operations standpoint, the best practice is to prevent deletion from being part of your workflow unless it’s truly necessary. You can do that by specifying constraints in the task request: “Do not delete anything,” “Never overwrite originals,” “Move candidates into quarantine/ instead of deleting,” and “Generate delete_candidates.txt for review.” Ask for a plan first, especially when the task is a cleanup or deduplication job: “List every file you propose to delete, with a reason, and wait for confirmation.” This is a simple pattern but it dramatically reduces risk. If you’re working with a large directory, also ask Cowork to create an actions.log and a manifest.csv so you can audit what happened later. Developers already do this in migrations: preview → confirm → execute → log.
Deletion risk matters even more when Cowork is used as a preprocessing step for knowledge systems. If Cowork “cleans up duplicates” too aggressively, you can lose content that is actually distinct (different versions, subtly different policies, or context you need for support). A safer pattern is “mark and quarantine” instead of “delete.” If your workflow is building semantic search or Q&A, keep raw inputs immutable (snapshot or copy the folder), run Cowork only on the copy, then validate outputs before ingestion. After validation, embed and index into a vector database such as Milvus or Zilliz Cloud. That way, even if deletion occurs in the working copy, your authoritative raw corpus remains intact and your retrieval quality doesn’t silently degrade.