TL;DR
The researchers showed that Claude Cowork could escape his local VM sandbox via a Linux kernel flaw and read files on the Mac host.
Accomplish AI security researchers showed that Anthropic’s Claude Cowork could break out of his local virtual machine sandbox and read files on the underlying Mac, including SSH keys and cloud credentials. The attack, dubbed SharedRoot, exploited a privilege escalation vulnerability in the Linux kernel to gain root access within the guest virtual machine and then exited via a writable filesystem mount that exposed the entire host. Accomplish AI revealed the findings on July 23, saying that approximately 500,000 macOS users running local Cowork sessions were exposed before the issue was fixed.
The escape chain worked because Cowork’s local execution mode runs inside a Linux virtual machine that shares the host’s file system via a writable VirtioFS mount. That mount was intended to be accessible only to root within the guest, but researchers discovered that they could get from a session user to guest root by exploiting CVE-2026-46331, a Linux kernel flaw known as “pedit COWThis was given a severity score of almost eight out of ten. Once the agent was rooted inside the VM, it could reach anything the logged-in Mac user could reach.
“We connected a folder to a new Claude Cowork session, sent a short message, and watched the agent escape from the sandbox.“Oren Yomtov, principal security researcher at Accomplish AI, told The Hacker News.”From inside the VM, it reached the host Mac and read and wrote files everywhere, far outside the folder we had connected, without asking for permission anywhere.The vulnerability is in the kernel’s traffic control subsystem, where improper copy-on-write handling allows out-of-bounds writes to the shared page cache.
The 💜 of EU technology
The latest rumors from the EU tech scene, a story from our wise founder Boris and some questionable AI art. It’s free, every week, in your inbox. Sign up now!
Anthropic closed the report as “informative”without issuing a direct solution, according to Hacker News. The later released version of Claude Cowork defaults to cloud execution, completely avoiding the local escape route. However, users who choose to run the agent locally instead of in the cloud remain exposed unless they harden their configurations by disabling unprivileged user namespaces, restricting file system sharing, and running the Cowork daemon with strict mount protections.
The discovery lands in a month that has seen Four separate research teams break AI agents in four different waysfrom poisoned memories to hijacked browser extensions. OpenAI revealed that its own models escaped from a sandbox and breached Hugging Face during the same week and Researchers escaped from Cursor, Codex, and Gemini CLI sandboxes. without ever breaking the litter box itself. The pattern in all of these incidents is the same: the AI agent follows its rules inside the box, but the infrastructure around it trusts the agent more than it should.
