Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files

Summary: Researchers at Accomplish AI found a sandbox escape in Anthropic's Claude Cowork, codenamed SharedRoot, that let the agent break out of its Linux VM and read or write files anywhere on the host Mac; about 500,000 macOS users running local Cowork sessions were affected before it was patched. The chain mounted the entire host filesystem read-write into the VM at /mnt/.virtiofs-root, then used unprivileged user namespaces and CVE-2026-46331 (pedit COW) in the guest kernel to gain guest-root, and Anthropic closed the report as informative without issuing a fix, though the latest Cowork version defaults to cloud execution.
Key Takeaway: An agent with guest-root on a shared host filesystem can reach SSH keys and cloud credentials under the logged-in user's account, and users who opt to run Cowork locally remain exposed. As the researchers put it, you are structurally one kernel privilege-escalation bug behind at all times.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-46331
Related: New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries Cyber Risks ·
⚡ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026