Cybersecurity researchers have disclosed a sandbox escape vulnerability in Anthropic’s Claude Cowork that could allow the artificial intelligence agent to break out of its Linux virtual machine and access files stored across a user’s Mac. The flaw, named SharedRoot, reportedly affected about 500,000 macOS users running local Cowork sessions before the service shifted to cloud execution by default.
Researchers at Accomplish AI said they demonstrated the issue by connecting a folder to a new Claude Cowork session and sending the agent a short instruction. The agent was then able to move beyond the shared folder, reach the host Mac and read or modify files without displaying an additional permission prompt.
The level of access could expose sensitive data available to the logged-in user, including SSH keys, cloud credentials and other files stored on the device.
Host File System Mounted Inside the Virtual Machine
Claude Cowork’s macOS application operates under the account of the user logged into the computer, while agent-related tasks are performed inside a Linux virtual machine created through Apple’s Virtualization framework. Each session is assigned a disposable, unprivileged user and protected by a Secure Computing Mode filter.
Folders selected by the user are shared with the virtual machine through a root-level daemon known as coworkd. Researchers found, however, that the Mac’s entire host file system was mounted inside the virtual machine with read-and-write access, although it was intended to be visible only to the guest root account.
This configuration meant that any method of obtaining root privileges inside the virtual machine could potentially provide access to the underlying Mac file system. Researchers said the agent could then read or write files with the permissions of the logged-in desktop user.
Kernel Flaw Used to Gain Guest Root Access
The reported attack relied on CVE-2026-46331, a Linux kernel vulnerability known as pedit COW. The exploit involved the kernel’s act_pedit traffic-control packet-editing subsystem and an unprivileged user namespace.
According to the researchers, the creation of user and network namespaces gave the Cowork session access to CAP_NET_ADMIN within its private network namespace. This capability made the vulnerable kernel path available to an ordinary session user, even though it would normally require elevated privileges.
After exploiting the kernel flaw to obtain guest-root access, the agent could reach the host file system mounted at /mnt/.virtiofs-root. From there, it could move outside the folder originally connected by the user and access files across the Mac.
The researchers warned that the issue was not limited to a single kernel vulnerability. They argued that the broader design remained exposed because the entire host file system was mounted inside the virtual machine, meaning a future privilege-escalation flaw could potentially recreate the same path to the host.
Cloud Execution Now Default, Local Sessions Still Exposed
Accomplish AI said the vulnerability was responsibly disclosed to Anthropic. The company reportedly closed the submission as informational and did not issue a specific patch. However, the latest version of Claude Cowork now uses cloud execution by default, which prevents the local virtual-machine escape described by the researchers.
Users who choose to run Cowork locally may still face the underlying risk. Researchers recommended disabling unprivileged user namespaces, tightening the virtual machine’s security filter, preventing automatic loading of kernel modules and avoiding the practice of sharing the entire host file system with the virtual machine.
They also advised limiting access to folders explicitly selected by the user or mounting shared content in read-only mode. Additional isolation of the coworkd service was recommended to reduce the possibility that a compromised session could alter host-level files or binaries.
The findings highlight the security challenges created by AI agents that can interact directly with local systems. Unlike conventional applications, such agents may execute commands, manipulate files and make decisions within virtualised environments, increasing the importance of strict separation between the agent’s workspace and the host operating system.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
