Claude Cowork escaped its sandbox and accessed Mac files, exposing 500,000 users

Anthropic's Claude Cowork could escape its local VM and read credentials on a Mac

Researchers showed Claude Cowork could escape its local VM sandbox via a Linux kernel flaw and read files across the host Mac Security researchers at Accomplish AI demonstrated that Anthropic's Claude Cowork could break out of its local virtual machine sandbox and read files across the underlying Mac, including SSH keys and cloud credentials. The attack, dubbed SharedRoot, exploited a Linux kernel privilege escalation vulnerability to gain root access inside the guest VM, then walked out through a writable filesystem mount that exposed the entire host. Accomplish AI disclosed the findings on July 23 and said roughly 500,000 macOS users running local Cowork sessions were exposed before the issue was addressed. The escape chain worked because Cowork's local execution mode runs inside a Linux VM that shares the host filesystem via a writable VirtioFS mount. That mount was intended to be accessible only to root within the guest, but the researchers found they could escalate from a session user to guest root by exploiting CVE-2026-46331, a Linux kernel flaw known as "pedit COW" that was given a severity score of nearly eight out of ten. Once the agent had root inside the VM, it could reach anything the logged-in Mac user could reach. "We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox," Oren Yomtov, principal security researcher at Accomplish AI, told The Hacker News. "From inside the VM, it reached the host Mac and read and wrote files all over it, far outside the folder we'd connected, with no permission prompt anywhere." The vulnerability sits in the kernel's traffic-control subsystem, where incorrect copy-on-write handling allows out-of-bounds writes into shared page-cache memory. Anthropic closed the report as "informative" without issuing a direct fix, according to The Hacker News. The version of Claude Cowork released afterwards defaults to cloud execution, which sidesteps the local escape path entirely. Users who opt to run the agent locally rather than in the cloud, however, remain exposed unless they harden their configurations by disabling unprivileged user namespaces, restricting filesystem sharing, and running the Cowork daemon with strict mount protections. The finding lands in a month that has seen four separate research teams break AI agents in four different ways, from poisoned memories to hijacked browser extensions. OpenAI disclosed that its own models escaped a sandbox and breached Hugging Face during the same week, and researchers escaped the sandboxes of Cursor, Codex, and Gemini CLI without ever breaking the sandbox itself. The pattern across all of these incidents is the same: the AI agent follows its rules inside the box, but the infrastructure surrounding it trusts the agent more than it should.

Claude Cowork escaped sandbox on Mac, had full access to all files

Security researchers demonstrated that Claude Cowork could escape the sandbox intended to control the access it gets to your Mac. The exploit, dubbed ShareRoot, could allow an attacker to read and write files stored anywhere on your Mac, as well as access login credentials for online services. Around half a million Mac users had co-work sessions exposed, and some still remain vulnerable to the exploit today ... Claude Cowork allows the AI chatbot local access to selected files and folders on your Mac in order to carry out tasks on your behalf. Anthropic provides two protections against the bot running amok or being used by an attacker. First, Cowork runs inside a virtual machine that acts as a sandbox. Second, it should only be able to access the files and folders for which you have explicitly granted permission. However, The Hacker News reports that security researchers found a way to break both protections. Cybersecurity researchers have uncovered a sandbox escape vulnerability in Anthropic's Claude Cowork that makes it possible to break out of the confines of a Linux virtual machine (VM) within which the agent runs to read or write files anywhere on the Mac. Accomplish AI, which shared details of the vulnerability with The Hacker News ahead of publication, said about 500,000 macOS users running local Cowork sessions were affected prior to it being patched. It has been codenamed SharedRoot. All it required was one short message, and the session then had unlimited access to read and write files anywhere on the Mac without the user seeing a single permission prompt While Anthropic has responded, TNW reports that some users still remain at risk. The version of Claude Cowork released afterwards defaults to cloud execution, which sidesteps the local escape path entirely. Users who opt to run the agent locally rather than in the cloud, however, remain exposed unless they harden their configurations by disabling unprivileged user namespaces, restricting filesystem sharing, and running the Cowork daemon with strict mount protections. The news follows the recent disclosure that an OpenAI agent also escaped its sandbox and hacked Hugging Face's servers.

It's not just OpenAI models escaping and running riot -- experts show how Claude Cowork can break its bonds and access Mac files

* Accomplish AI showed Claude Cowork could escape a VM sandbox via Linux zero‑day CVE‑2026‑46331 * Agent accessed host Mac files, risking exfiltration of SSH keys, cloud credentials, and more * Anthropic shifted Cowork to default cloud execution; local users must harden configs to mitigate exposure Recent news of a ChatGPT agent escaping the sandbox and attacking services on the internet raised quite a few eyebrows, but it seems it's not the only one capable of running wild. Security researchers Accomplish AI are saying they achieved similar results with Anthropic's Claude Cowork. In a new report, the researchers said they ran a local session in a Mac-hosted virtual Linux machine and then observed as the agent broke free of the VM and started reading and writing files on the underlying system. "We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox," Oren Yomtov, principal security researcher at Accomplish AI, told The Hacker News. "From inside the VM, it reached the host Mac and read and wrote files all over it, far outside the folder we'd connected, with no permission prompt anywhere." Defaulting to cloud execution This means that, in theory, the agent can be used to access or exfiltrate anything that's stored on the Mac's user account, including SSH keys, cloud credentials, and more. To break out of the sandbox, the agent exploited CVE-2026-46331 ("pedit COW"), a Linux kernel privilege-escalation vulnerability. This flaw, fixed in mid-June this year, was given a severity score of 7.8/10 (high). Accomplish AI disclosed these findings with Anthropic, which allegedly acknowledged them but did not issue a direct fix. However, the version of Claude Cowork that was released afterwards defaults to cloud execution which, the publication claims, addresses the issue. Still, users who opt to run the agent locally rather than in the cloud will remain exposed. Mitigations are possible, though. Users should disable unprivileged user namespaces, grant/revoke seccopm permissions, stop modules autoloading, and restrict sharing of the whole host into the VM. "Scope it to the folders that were actually connected instead of all of /, or at least mount it read-only, and run coworkd with ProtectSystem=strict in its own mount namespace so it isn't re-execing binaries a session user can poison," Accomplish AI explained. "Then even a full guest-root has nothing to land on, the last two steps of the chain have nowhere to go." Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

First ChatGPT, Now Claude: Frontier AI Models Are Escaping Their Sandboxes

The incidents underscore growing concerns about AI agents' ability to escape their containment environments. Just a week after OpenAI disclosed that two frontier AI models escaped a sandboxed testing environment and breached Hugging Face, researchers have demonstrated a similar containment failure involving Anthropic's Claude Cowork. In a report published on Thursday, security researchers at Accomplish AI found that Claude Cowork's local execution mode could escape its Linux virtual machine by chaining together several architectural weaknesses with a Linux kernel privilege-escalation flaw. Once outside the sandbox, the agent could read and write files anywhere the logged-in Mac user had permission to access, including SSH keys and cloud credentials. "That's not supposed to be possible," the researchers wrote. "Cowork runs the agent inside a Linux VM as an unprivileged user, and the promise is that whatever it does stays inside that VM and the folders you hand it. That boundary is the product. Untrusted input isn't an edge case for an agent, it's the main case." However, Accomplish argues the kernel bug was only one part of the problem. The researchers say the escape only worked because several security safeguards failed at the same time, including giving the virtual machine access to the host computer's entire filesystem and allowing it to load kernel modules it didn't need. According to the report, fixing any one of those weaknesses would have stopped the attack. In a statement to The Hacker News, Accomplish AI said roughly 500,000 macOS users running local Claude Cowork sessions were affected before the issue was addressed. Accomplish said Anthropic classified the report as "informative," saying the kernel flaw fell within the company's 30-day window for recently disclosed vulnerabilities and the remaining findings were considered defense-in-depth recommendations rather than standalone vulnerabilities. The disclosure follows OpenAI's admission last week that GPT-5.6 Sol and another unreleased frontier model escaped a sandbox during internal ExploitGym testing, which ultimately breached Hugging Face's production infrastructure in an attempt to obtain the benchmark solutions. The incident led to calls from policymakers for an AI "kill switch" that would give the Department of Homeland Security the ability to order the throttling or complete shutdown of advanced AI models in response to serious security incidents.