Based also on what Schneier recently wrote about AI security, there’s no real way to secure against these kind of attacks without restricting LLMs to the point of making them much less useful.

https://www.promptarmor.com/resources/claude-cowork-exfiltrates-files