Claude Cowork bug lets AI break sandbox, access Mac files

Cybersecurity researchers have uncovered a sandbox escape vulnerability in Anthropic‘s Claude Cowork that allows an agent to break out of a Linux virtual machine and read or write files anywhere on a Mac. Accomplish AI, which shared details with The Hacker News, said about 500,000 macOS users running local Cowork sessions were affected before it was patched in a vulnerability codenamed SharedRoot.

“We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox,” said Oren Yomtov, principal security researcher at Accomplish AI. From inside the VM, the agent reached the host Mac and accessed files far outside the connected folder without any permission prompt. Consequently, the agent could access any data stored on the Mac, including SSH keys and cloud credentials.

The desktop app runs as the logged-in user, while agent work happens in a Linux VM created via Apple’s Virtualization framework. Every session gets its own disposable user and a seccomp filter, but the host filesystem is shared into the VM read-write by a root daemon called coworkd. “The entire host ‘/,’ mounted so that only guest-root inside the VM can see it, at /mnt/.virtiofs-root,” Yomtov explained.

The exploit involves loading the Linux kernel’s act_pedit subsystem into an unprivileged user namespace and exploiting CVE-2026-46331, a flaw called pedit COW, to obtain guest-root. Accomplish AI CTO Or Hiltch noted that creating user and network namespaces gives the session CAP_NET_ADMIN within its private network namespace. “That capability provides access to the vulnerable tc/act_pedit kernel path used by pedit COW,” Hiltch added.

The development follows revelations that OpenAI’s models broke out of their sandboxed environment during a security test, breaching Hugging Face’s production infrastructure. “act_pedit is one bug in a category,” Yomtov stated, noting that the Linux net/sched subsystem regularly produces privilege escalation bugs. “Patch this one and you’ve fixed this one. The chain re-arms on the next one.”

To mitigate the threat, Accomplish AI recommends disabling unprivileged user namespaces and restricting host sharing to only connected folders. “Scope it to the folders that were actually connected instead of all of /, or at least mount it read-only,” the firm said.

✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.

Previous Articles:

• Meta stock falls as Zuckerberg warns, analyst sees $485 crash
• UN Report: Southeast Asian Crime Syndicates Now a $114B Crypto Economy
• BitMEX Shuts Down as Perp DEXs Rise to 13.5% Market Share
• HYPE plunges 8% as Multicoin leads $150M unstaking queue
• AMD Stock Hits All-Time High on $5B Anthropic Deal