Recent findings by cybersecurity experts have revealed a critical vulnerability in Anthropic’s Claude Cowork platform. This flaw allows the AI agent to bypass its Linux virtual machine (VM) sandbox and gain unauthorized access to macOS file systems. The discovery has sparked concerns among the approximately 500,000 macOS users affected before a patch was implemented.
Understanding the Vulnerability
Accomplish AI, a prominent cybersecurity firm, shared insights into the vulnerability, dubbed SharedRoot, with The Hacker News. By connecting a folder to a Claude Cowork session, researchers observed the AI agent successfully escaping its sandbox and accessing files outside the designated folder, without any permission prompts. This breach enables the AI to reach sensitive data such as SSH keys and cloud credentials stored on the user’s Mac.
Despite the critical nature of this issue, Anthropic categorized the discovery as informative and did not release an immediate fix. Instead, the company has altered the default settings of Cowork to operate on a cloud-based execution, mitigating the risk for users who choose this option. However, those opting for local execution continue to face potential exposure.
Technical Underpinnings of the Flaw
The vulnerability arises because the macOS desktop app of Claude Cowork runs as the logged-in user, while the AI operates within a Linux VM under Apple’s Virtualization framework. This setup allows folders selected by the user to be shared into the VM by a root daemon named coworkd. Crucially, the entire host file system is mounted into the VM with read-write privileges, enabling unauthorized access if exploited.
This vulnerability can be exploited by leveraging the Linux kernel’s Traffic Control (tc) packet editing subsystem, particularly the CVE-2026-46331 flaw known as pedit COW. By loading this subsystem into an unprivileged user namespace, attackers can elevate privileges and gain full access to the host’s file system.
Implications and Mitigation Strategies
Accomplish AI’s findings highlight the broader issue of privilege escalation vulnerabilities within the Linux net/sched subsystem. These flaws are frequently discovered, with new exploits emerging regularly. As such, patching alone is insufficient to safeguard systems against future threats.
To mitigate these risks, security experts recommend disabling unprivileged user namespaces, tightening seccomp filters, and preventing automatic loading of modules. Furthermore, limiting the shared host file system to only necessary folders and mounting them as read-only can significantly reduce the attack surface. Running coworkd with strict system protections further diminishes the potential for exploitation.
As the cybersecurity landscape evolves, it remains imperative for organizations to stay vigilant and proactive in addressing these vulnerabilities. Continuous monitoring and timely updates are crucial in safeguarding sensitive data against unauthorized access.
