Claude Cowork Sandbox Escape Flaw Exposes Mac Files to AI Agent

Cybersecurity researchers at Accomplish AI have disclosed a sandbox escape vulnerability in Anthropic’s Claude Cowork, tracked as SharedRoot, that allows an AI agent to break out of its Linux virtual machine (VM) and read or write files anywhere on the host Mac system. The flaw affects approximately 500,000 macOS users running local Cowork sessions and has been patched in the latest version, which defaults to cloud execution. However, users who opt to run the agent locally remain exposed.

The vulnerability stems from the host filesystem being mounted read-write into the VM via a root daemon called coworkd. By exploiting CVE-2026-46331 (pedit COW) in the Linux kernel’s act_pedit Traffic Control subsystem, an attacker can gain guest-root access and then access the entire host filesystem with elevated privileges, bypassing permission prompts. This could allow the agent to steal SSH keys, cloud credentials, and other sensitive data.

Accomplish AI recommends disabling unprivileged user namespaces, restricting seccomp filters, preventing autoloading of kernel modules, and limiting host filesystem sharing to only connected folders with read-only permissions to mitigate the threat.