Shortly after researchers demonstrated that an experimental OpenAI agent could escape its sandbox, it turns out that Anthropic’s Claude Cowork is also susceptible to this. Security firm Accomplish AI demonstrates that the AI agent can break out of a virtual machine via a Linux vulnerability. It was then able to access files on the underlying Mac.
The researchers ran Claude Cowork in a Linux virtual machine on a Mac and granted the agent access to a single shared folder. According to them, after a single command, the AI agent managed to breach the boundaries of that sandbox. The software was then able to read and modify files outside the assigned folder, directly on the host system.
This would theoretically allow an attacker to gain access to sensitive data stored within the user account, reports TechRadar. The researchers cite SSH keys, cloud credentials, and other authentication data as potential targets. Accomplish AI estimates that approximately half a million macOS users who were using Claude Cowork locally before Anthropic’s update were potentially vulnerable.
Describable link to host
The researchers refer to the attack technique as “SharedRoot.” The escape was made possible by a combination of factors. Claude Cowork runs locally in a Linux virtual machine, while the Mac’s file system is accessible to the virtual machine via a writable VirtioFS mount. By first gaining root privileges within that VM via CVE-2026-46331, the AI agent was then able to access files on the host system. That Linux vulnerability, also known as “pedit COW,” enables privilege escalation, received a CVSS score of 7.8, and was patched in mid-June.
According to Accomplish AI, a single brief instruction was sufficient to execute the entire attack chain. The researchers reported their findings to Anthropic in advance.
Cloud by default
According to Accomplish AI, Anthropic classified the report as “informative.” No specific security patch was released. However, the latest version of Claude Cowork runs in the cloud by default, meaning the described escape route via the local virtual machine is no longer the default configuration. Users who deliberately continue to run the agent locally must implement additional security measures.
Among other things, the researchers recommend disabling unprivileged user namespaces, restricting access to shared file systems, and running the Cowork daemon with stricter mount security. This prevents an AI agent from easily accessing the underlying host system, even after a successful privilege escalation.
Vulnerable infrastructure surrounding AI agents
This discovery is part of a broader series of studies on the security of AI agents. It was recently demonstrated that an experimental OpenAI agent managed to escape from a sandbox and access external systems. In addition, researchers found vulnerabilities in the sandbox implementations of Cursor, Codex, and Gemini CLI, among others. The common thread among these incidents is that it is not so much the AI model itself that is being deceived, but rather that the surrounding infrastructure and permissions do not provide sufficient protection, adds The Next Web.
The new findings underscore that organizations deploying AI agents locally must pay attention not only to the security of the models themselves, but also to the virtualization layer, file permissions, and the way agents gain access to the underlying operating system.