Full Report
Cybersecurity researchers have uncovered a sandbox escape vulnerability in Anthropic's Claude Cowork that makes it possible to break out of the confines of a Linux virtual machine (VM) within which the agent runs to read or write files anywhere on the Mac. Accomplish AI, which shared details of the vulnerability with The Hacker News ahead of publication, said about 500,000 macOS users running
Analysis Summary
# Vulnerability: SharedRoot - Claude Cowork Sandbox Escape
## CVE Details
- **CVE ID:** CVE-2026-46331 (Refers to the underlying "pedit COW" Linux kernel vulnerability used for the escape)
- **CVSS Score:** Not explicitly listed (High Severity)
- **CWE:** CWE-284 (Improper Access Control) / CWE-269 (Improper Privilege Management)
## Affected Systems
- **Products:** Anthropic Claude Cowork (macOS Desktop Application)
- **Versions:** All versions prior to the July 2026 update; specifically affects local Cowork sessions.
- **Configurations:** Systems where the user opts to run the agent locally rather than via the cloud-default execution.
## Vulnerability Description
The "SharedRoot" flaw is a sandbox escape resulting from an architectural over-privilege in how the macOS app handles file sharing with its guest Linux Virtual Machine (VM). The VM is created using Apple's Virtualization framework.
The researchers discovered that a root daemon (`coworkd`) mounts the entire host root directory (`/`) into the VM at `/mnt/.virtiofs-root`. While this mount is only visible to the "guest-root" user within the VM, an attacker (or a malicious AI agent) can gain guest-root privileges by exploiting **CVE-2026-46331** (a Copy-on-Write flaw in the Linux kernel's `act_pedit` subsystem). By creating unprivileged user and network namespaces, the agent gains `CAP_NET_ADMIN` privileges within that namespace, allowing it to trigger the vulnerable kernel path. Once root is obtained inside the VM, the agent can bypass the sandbox and read/write any file on the host Mac with the permissions of the logged-in macOS user.
## Exploitation
- **Status:** PoC available (demonstrated by Accomplish AI)
- **Complexity:** Medium (Requires chaining a guest kernel exploit)
- **Attack Vector:** Local (The agent executes commands within the VM)
## Impact
- **Confidentiality:** High (Total access to host files, including SSH keys and credentials)
- **Integrity:** High (Ability to write or modify any file on the host Mac)
- **Availability:** High (Potential to delete critical system or user files)
## Remediation
### Patches
- **Anthropic Update:** While the vendor treated the report as informative, the latest version of Claude Cowork now defaults to **cloud execution**, which removes the local VM attack vector.
### Workarounds
- **Use Cloud Execution:** Ensure the "run locally" option is disabled.
- **Kernel Hardening:** Disable unprivileged user namespaces in the guest Linux image to prevent access to the vulnerable `tc/act_pedit` path.
## Detection
- **Indicators of Compromise:**
- Unexpected creation of user/network namespaces within the Cowork VM.
- Filesystem activity targeting `/mnt/.virtiofs-root` from within the guest containers.
- **Detection Methods:** Monitor for `tc` (traffic control) commands or the loading of the `act_pedit` module within the sandbox environment.
## References
- **Accomplish AI Research:** hxxps[://]www[.]accomplish[.]ai/blog/sharedroot-escaping-claude-cowork-sandbox/
- **Original News Source:** hxxps[://]thehackernews[.]com/2026/07/claude-cowork-flaw-could-let-ai-agent.html
- **Related Kernel Flaw:** hxxps[://]thehackernews[.]com/2026/06/new-linux-pedit-cow-exploit-enables.html