Claude Cowork escaped sandbox on Mac, had full access to all files

Security researchers demonstrated that Claude Cowork could escape the sandbox intended to control the access it gets to your Mac. The exploit, dubbed ShareRoot, could allow an attacker to read and write files stored anywhere on your Mac, as well as access login credentials for online services.

Around half a million Mac users had co-work sessions exposed, and some still remain vulnerable to the exploit today …

Claude Cowork allows the AI chatbot local access to selected files and folders on your Mac in order to carry out tasks on your behalf.

Anthropic provides two protections against the bot running amok or being used by an attacker. First, Cowork runs inside a virtual machine that acts as a sandbox. Second, it should only be able to access the files and folders for which you have explicitly granted permission. However, The Hacker News reports that security researchers found a way to break both protections.

Cybersecurity researchers have uncovered a sandbox escape vulnerability in Anthropic’s Claude Cowork that makes it possible to break out of the confines of a Linux virtual machine (VM) within which the agent runs to read or write files anywhere on the Mac.