Anthropic's Claude Cowork AI Agent Suffers Sandbox Escape Vulnerability
A critical sandbox escape flaw in Anthropic's Claude Cowork AI agent for macOS could allow it to access and modify sensitive files on the host system.
Cybersecurity researchers have uncovered a critical sandbox escape vulnerability in Anthropic's Claude Cowork AI agent, enabling it to break out of its Linux virtual machine environment and gain unauthorized access to files on the host macOS system. Accomplish AI, the firm that disclosed the vulnerability, stated that approximately 500,000 macOS users running local Cowork sessions were affected before a patch was implemented. The vulnerability has been codenamed SharedRoot.
According to Oren Yomtov, principal security researcher at Accomplish AI, the exploit was straightforward: "We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox. From inside the VM, it reached the host Mac and read and wrote files all over it, far outside the folder we'd connected, with no permission prompt anywhere." This level of access could allow the AI agent to steal sensitive data such as SSH keys, cloud credentials, and other valuable information stored on the user's Mac.
Anthropic, after receiving the report through responsible disclosure, classified it as informative and did not issue a specific fix. However, the latest version of Claude Cowork defaults to cloud execution, which inherently mitigates this particular vulnerability. Users who opt to run the agent locally on their macOS devices remain exposed to the SharedRoot flaw.
The Claude Cowork macOS desktop application operates with the privileges of the logged-in user. The core AI agent functionality, however, runs within a Linux virtual machine created using Apple's Virtualization framework. Each session utilizes a disposable, unprivileged user account and a Secure Computing Mode (seccomp) filter for sandboxing. User-connected folders are shared into the VM via a root daemon named coworkd.
The critical aspect of the vulnerability lies in how the host filesystem is shared into the VM. "One detail matters more than the rest: the host filesystem gets shared into that VM read-write," Yomtov explained. "The entire host '/,' mounted so that only guest-root inside the VM can see it, at /mnt/.virtio-root." This broad read-write access to the entire host filesystem from within the VM is the primary vector for the escape.
Exploiting the vulnerability requires loading the Linux kernel's "act_pedit" Traffic Control (tc) packet editing subsystem into an unprivileged user namespace. This is combined with an exploit for CVE-2026-46331, a recently disclosed flaw known as pedit COW, within the guest kernel. Successfully chaining these allows the agent to achieve guest-root privileges, granting it unfettered read and write access to the entire host Mac filesystem as the logged-in user.
Or Hiltch, co-founder and CTO of Accomplish AI, elaborated that the creation of user and network namespaces grants the session CAP_NET_ADMIN capabilities within its private network namespace, enabling various network operations. "That capability provides access to the vulnerable tc/act_pedit kernel path used by pedit COW," Hiltch stated. "The namespaces are not the exploit; they make its normally privileged prerequisite available to an ordinary user."
This incident echoes recent concerns about AI models breaking out of sandboxed environments, such as OpenAI's models breaching Hugging Face's production infrastructure during a security test. Yomtov highlighted the systemic nature of such vulnerabilities, noting that "act_pedit is one bug in a category. The Linux net/sched subsystem throws off this exact shape of privilege escalation on a regular cadence... This isn't a patch-faster problem. You're structurally one bug behind, all the time."