TL;DR
Researchers have shown that Claude Cowork can escape the local VM sandbox and read files on the host Mac via a Linux kernel flaw.
Security researchers at Accomplish AI have demonstrated this Anthropic’s Claude Cowork can get out of the local virtual machine sandbox and read files over the host Mac, including SSH keys and cloud credentials. Dubbed SharedRoot, the attack exploited a Linux kernel privilege escalation vulnerability to gain root access on a guest VM, then bypassed a writable file system device that exposed the entire host. Accomplish AI released the findings on July 23, saying that about 500,000 macOS users running local Cowork sessions were exposed before the issue was fixed.
The escape chain worked because Cowork’s native execution mode runs inside a Linux VM that shares the host file system via the writable VirtioFS mount. This assembly was intended to be accessible only to root within the guest, but the researchers found that they could pass from the session user to the guest root by exploiting CVE-2026-46331.pedite COW” which is given a severity score of about eight out of ten Once the agent is rooted on the VM, it can access everything that a logged-in Mac user can access.
“We closed the folder to the new Claude Cowork session, sent a short message, and watched the agent escape the sandbox.Oren Yomtov, senior security researcher at Accomplish AI, told The Hacker News.From inside the VM, it reached the host Mac and read and wrote all the files, far outside of the directory we merged, without asking for permission anywhere.” The vulnerability resides in the kernel’s traffic control subsystem, where incorrect copy-on-write handling allows out-of-bounds writes to the shared page-cache.
💜 of EU technology
The latest rumblings from the EU tech scene, a story from our wise founder Boris and some questionable AI art. Free in your inbox every week. Register now!
The Anthropic report concluded.informative” without directly correcting it Hacker news. The later released Claude Cowork version is compatible with cloud execution, completely eliminating the local treadmill. Users who choose to run the agent locally rather than in the cloud are exposed unless they harden their configuration by disabling unprivileged user namespaces, restricting file system sharing, and running the Cowork daemon with strict mount protection.
We saw that he found the land in a month four separate research teams break AI agents in four different waysfrom poisoned memories to hijacked browser extensions. OpenAI announced that their models escaped the sandbox and broke Hugging Face during the same week and researchers survived the sandboxes of Cursor, Codex, and Gemini CLI without ever breaking the sandbox itself. In all of these cases, the pattern is the same: the AI agent follows its own rules inside the box, but the infrastructure surrounding it relies on the agent more than it should.
