TL;DRResearchers showed Claude Cowork could escape its local VM sandbox via a Linux kernel flaw and read files across the host Mac
Security researchers at Accomplish AI demonstrated that Anthropic’s Claude Cowork could break out of its local virtual machine sandbox and read files across the underlying Mac, including SSH keys and cloud credentials. The attack, dubbed SharedRoot, exploited a Linux kernel privilege escalation vulnerability to gain root access inside the guest VM, then walked out through a writable filesystem mount that exposed the entire host. Accomplish AI disclosed the findings on July 23 and said roughly 500,000 macOS users running local Cowork sessions were exposed before the issue was addressed.
The escape chain worked because Cowork’s local execution mode runs inside a Linux VM that shares the host filesystem via a writable VirtioFS mount. That mount was intended to be accessible only to root within the guest, but the researchers found they could escalate from a session user to guest root by exploiting CVE-2026-46331, a Linux kernel flaw known as “pedit COW” that was given a severity score of nearly eight out of ten. Once the agent had root inside the VM, it could reach anything the logged-in Mac user could reach.
