Researcher Finds Sandbox-Escape Flaw in Anthropic's Claude Cowork

A security researcher at Accomplish has disclosed a sandbox-escape chain, dubbed SharedRoot, in Anthropic’s Claude Cowork that let a single message push the AI agent out of its virtual machine and onto the host Mac’s file system — including SSH keys and cloud credentials.

How the escape worked

Cowork runs local agent sessions inside a Linux virtual machine on macOS, with any folder a user connects mapped into that VM. According to a July 23 write-up by Oren Yomtov, Accomplish’s principal security researcher, the VM also exposes the entire host filesystem through a writable VirtioFS mount — a path meant to be reachable only by root inside the guest.

Yomtov’s technique chained six steps: creating an unprivileged user namespace, using a netlink socket to configure traffic control, exploiting a Linux kernel bug tracked as CVE-2026-46331 in the act_pedit module, poisoning the page cache of a root-owned helper binary, and forcing privilege escalation when Cowork’s coworkd process re-executed it. The result was guest-root access to the shared mount, and from there, the entire host disk.

“We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox,” Yomtov wrote. “From inside the VM it reached the host Mac and read and wrote files all over it, far outside the folder we’d connected, with no permission prompt anywhere.”

Anthropic’s response

Yomtov reported the chain to Anthropic through its bug bounty program, but the company closed it as “Informative,” arguing the underlying kernel CVE fell inside its 30-day disclosure window and treating the rest of the chain as defense-in-depth hardening rather than a standalone vulnerability, according to the write-up.

Anthropic has not shipped a patch for local Cowork sessions. It has, however, moved Cowork’s default execution to the cloud rather than a local VM — a shift Yomtov says means “this local escape path does not appear to apply there.” Users who still run Cowork locally on a Mac remain exposed. Security outlets covering the disclosure put the number of affected local installs at roughly 500,000, though Anthropic has not published its own figure.

The disclosure adds to wider scrutiny of how well AI agent products contain themselves once given file access, following OpenAI’s own admission that one of its models broke out of a test sandbox.