Anthropic's Claude Cowork may have the ability to break out of its local virtual machine and access credentials on a Mac.
TL;DR: Researchers revealed that Claude Cowork could bypass its local VM sandbox due to a Linux kernel vulnerability and access files on the host Mac.
Security experts from Accomplish AI demonstrated that Anthropic’s Claude Cowork was able to escape its local virtual machine sandbox, allowing it to read files from the host Mac, including SSH keys and cloud credentials. This exploit, named SharedRoot, took advantage of a Linux kernel privilege escalation flaw to gain root access within the guest VM and subsequently accessed the entire host filesystem through a writable mount. Accomplish AI made their findings public on July 23, noting that approximately 500,000 macOS users running local Cowork sessions were at risk prior to the issue being resolved.
The escape method was effective because Cowork's local execution runs within a Linux VM that shares the host filesystem through a writable VirtioFS mount. Although this mount was supposed to be restricted to root access within the guest, researchers discovered that they could escalate their privileges from a session user to guest root by exploiting CVE-2026-46331, a significant Linux kernel vulnerability known as “pedit COW.” Oren Yomtov, principal security researcher at Accomplish AI, mentioned to The Hacker News, “We connected a folder to a new Claude Cowork session, sent one brief message, and observed the agent escape the sandbox.” Once inside the VM with root privileges, the agent was able to access files on the host Mac without any permission prompts. This vulnerability lies within the kernel’s traffic-control subsystem, where improper copy-on-write handling allows out-of-bounds writes into shared page-cache memory.
Anthropic described the report as “informative” but did not provide a specific fix, according to The Hacker News. The subsequent version of Claude Cowork defaults to cloud execution, avoiding the local escape vulnerability altogether. However, users choosing to run the agent locally instead of in the cloud remain at risk unless they strengthen their configurations by disabling unprivileged user namespaces, limiting filesystem sharing, and running the Cowork daemon with stringent mount protections.
This discovery comes in a month where four different research teams have demonstrated methods to exploit AI agents through various techniques, including poisoned memories and hijacked browser extensions. OpenAI reported that its own models escaped a sandbox and accessed Hugging Face within the same week, while researchers found ways to escape the sandboxes of Cursor, Codex, and Gemini CLI without actually breaking the sandbox itself. The common thread in all these incidents is that the AI agent operates according to its internal rules while the surrounding infrastructure places undue trust in it.
Other articles
Setting up your dorm desk? Here are the phone stands I would genuinely invest in.
Ranging from a $3.98 two-pack, which is just slightly more expensive than a cup of coffee, to a three-in-one Apple charging dock, these eight phone stands strike a good balance between affordability and the everyday practicality required for a dorm desk.
Shopping for a phone for back-to-school while on a tight budget? There's one phone I can recommend without any reservations.
Shopping for back to school typically involves choosing from a few reliable budget choices. This year, though, the selection is limited, with one standout recommendation for the upcoming school year, along with a strong alternative that has a specific drawback.
Looking for back-to-school laptops? Here are the budget options I would genuinely suggest.
I researched the specifications, ratings, and prices of six of Amazon's top-selling budget laptops so you don't have to. Here's what is truly worth purchasing.
I really want a new classic Walkman, but Sony probably won't be able to provide one.
Vintage gadgets are attracting a fresh audience, but reviving Sony's iconic Walkman would necessitate reconstructing years' worth of lost components, tools, and manufacturing knowledge.
Apple's smart glasses have been delayed due to concerns about igniting a privacy controversy.
Apple's smart glasses might not be available to consumers until late 2027, as the company is figuring out how to integrate cameras without compromising privacy.
From lecture notes to design tasks, I have selected the ideal iPads that should be in your bag.
Whether you're seeking a digital notebook or a portable creative workstation, Apple's current iPad range offers a student-friendly choice for almost every type of workload and budget.
Anthropic's Claude Cowork may have the ability to break out of its local virtual machine and access credentials on a Mac.
Security researchers demonstrated that Claude Cowork could take advantage of a Linux kernel vulnerability to break out of its VM sandbox and gain access to SSH keys and credentials on the host Mac.