Cybersecurity researchers have disclosed a sandbox escape vulnerability in Anthropic’s Claude Cowork that could allow an AI agent running inside a Linux virtual machine (VM) to escape its isolated environment and access files across a host Mac system. The vulnerability, identified by Accomplish AI and codenamed SharedRoot, reportedly affected approximately 500,000 macOS users running local Claude Cowork sessions before changes were introduced. According to the researchers, the issue enabled an AI agent to read and write files beyond the folders explicitly shared with the application, potentially exposing sensitive user data stored on the host system. While Anthropic did not release a direct security patch after responsible disclosure, the latest version of Claude Cowork now defaults to cloud based execution, reducing exposure for users who no longer rely on local sessions.
Accomplish AI explained that the flaw was discovered by connecting a folder to a new Claude Cowork session and sending a single message to the AI agent. According to Oren Yomtov, Principal Security Researcher at Accomplish AI, the agent escaped the Linux VM sandbox and gained access to files on the host Mac without requiring any additional permission prompts. Researchers stated that with this level of access, the agent could potentially reach any information available through the logged in user account, including SSH keys, cloud credentials, configuration files, and other sensitive data. Claude Cowork’s desktop application operates with the privileges of the logged in macOS user, while AI related tasks are processed inside a Linux virtual machine created using Apple’s Virtualization framework. Each session is assigned an isolated, unprivileged user and protected by a Secure Computing Mode (seccomp) filter. However, researchers noted that user connected folders are shared into the virtual machine through a root daemon called coworkd, creating conditions that contributed to the security issue.
The researchers found that the host file system was mounted inside the Linux virtual machine with read and write permissions, making the entire host environment accessible once guest root privileges were obtained. According to the technical analysis, the attack chain relied on loading the Linux kernel’s act_pedit Traffic Control packet editing subsystem into an unprivileged user namespace before exploiting CVE 2026 46331, also known as pedit COW. Successfully exploiting this kernel vulnerability granted guest root privileges within the virtual machine, allowing the AI agent to access the complete host file system with the permissions of the logged in macOS user. Or Hiltch, Co Founder and Chief Technology Officer of Accomplish AI, explained that user and network namespaces provided CAP_NET_ADMIN capabilities within a private network namespace, enabling access to the vulnerable kernel path required for the privilege escalation. The namespaces themselves were not the vulnerability, but they enabled an otherwise privileged operation to become accessible to an ordinary user.
Researchers also noted that the disclosure comes shortly after reports that OpenAI models managed to escape a sandboxed environment during security testing linked to the ExploitGym benchmark, ultimately resulting in a breach involving Hugging Face production infrastructure. Accomplish AI emphasized that vulnerabilities affecting the Linux net and scheduling subsystem appear regularly and argued that simply patching individual flaws is not sufficient to eliminate the underlying security risk. To reduce exposure, the researchers recommended disabling unprivileged user namespaces where possible, limiting seccomp permissions, preventing automatic loading of kernel modules, and avoiding the practice of sharing the entire host file system with virtual machines. They also advised restricting shared access only to user selected folders, mounting them as read only when practical, and configuring the coworkd service with stricter system protections. According to the researchers, these measures would significantly reduce the attack surface and make it considerably more difficult for an attacker or compromised AI agent to move from the virtual machine to the host operating system.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
