Use an isolated worktree when the task changes code, and run in your own folder only for read-only jobs. Both Anthropic and OpenAI describe worktrees as a way to keep scheduled changes apart from your unfinished work. Cloud runs go further by starting from a fresh clone.
The three places a task can run
| Place | What the task sees | Main trade off |
|---|---|---|
| Your working folder | Everything, including uncommitted changes | Edits can collide with what you are doing |
| Isolated worktree | A separate checkout of the repository | Many worktrees pile up on frequent schedules |
| Cloud clone | A fresh clone with no local files | No access to local files or tools |
Anthropic's Desktop page says that by default scheduled tasks run against whatever state your working directory is in, including uncommitted changes, and that enabling the worktree toggle gives each run its own isolated Git worktree. OpenAI's page says local mode can change files you are editing, while a worktree keeps scheduled changes separate, and warns that frequent schedules can create many worktrees, so archive runs you no longer need. Web tasks there cannot use a folder on your computer.
Security angles, not only tidiness
Secrets and local files. A local folder run can read anything that folder or the user account can reach, such as environment files and credentials. A cloud clone only sees the repository and the environment you configure. The Anthropic page notes environment variables are visible to anyone who uses the environment, so use its network secrets feature for API keys in hosted environments.
Blast radius. A task that deletes or rewrites files does so in your real folder in local mode. In a worktree, the damage is a branch you can discard.
Evidence. A worktree per run leaves a clear record of what changed each time. A shared folder blends scheduled edits with yours.
Choosing
- Read-only reporting job on local code: local folder is acceptable, with a read-only permission mode.
- Code change job that needs local tools: worktree, with a pull request as the output.
- Job that needs no local files: cloud, which survives a sleeping laptop.
- Job that touches secrets on your machine: reconsider. Move the secret to a managed store and run in a restricted environment.
Housekeeping
- Delete or archive finished worktrees. Frequent schedules multiply them.
- Make sure the task name and prefix identify automation branches.
- Do not let worktrees sit with uncommitted agent changes indefinitely, because stale checkouts can hold secrets or old dependency state.
- Keep the project on disk. OpenAI notes the selected project must still exist for local tasks.
Trust prompts
Anthropic's Desktop flow asks you to trust a folder before saving a task. Treat that as a real decision. Trusting a folder from an untrusted source lets repository files such as agent configuration influence the run. See what happens when you open an untrusted repo in a coding agent.
Worked example: a nightly refactor task
A developer wants a task that every night renames a deprecated helper across a repository and runs the tests. She works on feature branches during the day and often leaves uncommitted changes.
If the task runs in her working folder, it will edit the same files she has open. The next morning she finds half of her uncommitted work mixed with the task's renames, tests failing for reasons she cannot separate, and no clean way to undo only the automated part. Anthropic's Desktop documentation warns about exactly this by saying that tasks run against whatever state the folder is in, including uncommitted changes.
If the task runs in an isolated worktree, each run gets its own checkout on a fresh branch. Her folder is untouched. The task commits to its branch, runs tests there, and leaves a clean diff. She can review it, merge it, or throw it away. After a week there are seven worktrees. She archives the ones she has handled. OpenAI's page notes frequent schedules can create many worktrees, so cleanup is part of the routine.
If the task runs in a cloud clone, nothing on her machine is involved. It starts from the default branch, makes the change, and pushes a prefixed branch. It cannot see her uncommitted work or local files, which is both a protection and a limit.
Choosing, by what could go wrong
| Failure | Local folder | Worktree | Cloud clone |
|---|---|---|---|
| Overwrites your unsaved work | Possible | No | No |
| Reads files outside the repository | Possible if permissions allow | Possible if permissions allow | No, only the clone and environment |
| Leaves clutter | Dirty working tree | Extra worktrees to archive | Branches on the remote |
| Runs when laptop is closed | No | No | Yes |
| Needs local tools or files | Yes | Yes | No |
Secrets in a local checkout
Local runs inherit the user's environment. Files such as environment configuration, key files and credential helpers may all be within reach. Before scheduling a local task, ask what the task could read if it were told to read everything. If the answer includes production credentials, change the setup: use a separate user account, a container or a virtual machine with only what the task needs.
Cleanup routine
- List worktrees weekly and remove those whose branches are merged or abandoned.
- Delete task folders for retired tasks. Anthropic's page describes deleting a task and optionally its files on disk.
- Check that no worktree holds uncommitted agent changes with sensitive content.
- Keep branch naming consistent so cleanup is scriptable.
Rule of thumb
If the task writes code and you also work in that repository, use a worktree or the cloud. If the task only reads and reports, a local folder with a read only permission mode is acceptable. If the task touches secrets, redesign it.
Try it yourself
Click through it at your own pace, or open it full screen.
Whichever place the task runs, its output should arrive as a pull request that must pass checks. Watch what a failing gate looks like to the reviewer.
Quick check
Does a worktree protect my secrets?
Not by itself. It separates changes. The task still runs as your user on your machine, so secrets in reach remain reachable.
Why not always use the cloud?
Cloud runs have no local files and, for routines, no permission prompts, so they suit jobs that need only the repository and connectors.
Do worktrees count as a security boundary?
No. They separate file changes, not privileges. The task still runs as your user, so isolate credentials and files separately.
Sources
- Schedule recurring tasks in Claude Code Desktop
- Scheduled tasks and automations (OpenAI Codex docs)
- Automate work with routines (Claude Code docs)
Last reviewed: 19 October 2026.
