Whether you like it or not: This is the reality of over-aggressive guardrails.
Especially when the AUP is so annoying to recover from with Claude code CLI wrapping bots.
Cowork spins up a linux vm (from rootfs.img) that isolates Claude Code from network (except as allowed in egress domains via domain sockets and proxies from an isolated network), execution (vm+bubblewrap) and file access (you pick folders to be mounted to a specific session). Basically it can YOLO on its own with pre-installed libraries, and unless it pops out of bubblewrap it's not accessing network/files that haven't been shared with it.