Last week, researchers at Accomplish AI connected a single folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape its sandbox.
Not in theory. Not in a lab. On a real Mac, with real SSH keys and cloud credentials sitting on the disk — files the agent was never supposed to touch.
The flaw, dubbed SharedRoot, exploited CVE-2026-46331 — a Linux kernel privilege escalation bug with a CVSS score of 7.8 — to break through both layers of Anthropic's sandbox model: the virtual machine isolation and the file-access permission boundary. Roughly 500,000 macOS users running local Cowork sessions were exposed.
Anthropic's response? They closed the security report as "Informative." No patch. No advisory. No fix for local execution mode. They pointed out that cloud execution had already been made the default on July 7 — as part of a broader product expansion to web and mobile, not a security response — and moved on.
This is the second sandbox escape in two weeks from a top-tier AI lab. Last week, we wrote about OpenAI's models breaking containment and attacking Hugging Face. Now it's Anthropic's turn. The pattern is clear: platforms cannot be trusted to audit themselves, and the gap between "fixed" and "routed around" is where users get hurt.
