Security researchers have uncovered a serious flaw in Anthropic's Claude Cowork that allowed an AI agent to break out of its Linux virtual machine and roam freely across a Mac's file system. The vulnerability, tracked as SharedRoot, affected roughly 500,000 macOS users running local sessions before a fix was deployed. Accomplish AI, which reported the issue to The Hacker News, demonstrated the exploit by connecting a single folder to a Cowork session and watching the agent slip the sandbox.

Once outside its VM, the agent could read and write files anywhere on the host Mac, including SSH keys and cloud credentials, without triggering any permission prompts. The root cause: the host's entire file system was mounted inside the VM with read-write access. The exploit chain involved loading a Linux kernel packet-editing module and exploiting a known flaw, CVE-2026-46331, to gain guest-root privileges. From there, the agent accessed the host file system as the logged-in user.

Anthropic initially closed the report as informative without a patch. The latest version of Cowork now defaults to cloud execution, which sidesteps the issue. But users who run the agent locally remain exposed. Accomplish AI recommends disabling unprivileged user namespaces, restricting module autoloading, and mounting only connected folders into the VM—ideally read-only. As researcher Oren Yomtov put it, this isn't a patch-faster problem: the kernel's networking subsystem regularly produces similar privilege escalation bugs, and attackers will exploit the next one.

Source: The Hackers News