A serious security flaw has been discovered in Claude Cowork’s local sandbox, allowing a malicious AI agent to escape its Linux virtual machine (VM) and access the host Mac’s filesystem.
This breach can enable the agent to read sensitive information, including SSH private keys and cloud credentials, without any user prompts.
The root of this issue is not attributed to a single kernel vulnerability. However, it stems from four questionable design choices regarding the integration of the sandbox, kernel features, and the host filesystem.
Security researchers from Accomplish have identified an attack method called “SharedRoot,” which enables untrusted content within a Claude Cowork session to escape its VM and interact directly with the host macOS filesystem.
By establishing a shared folder in a new Cowork session and using a crafted prompt, they demonstrated the ability to read and write files across the host user’s account, far surpassing the boundaries of the intended shared folder.
Cowork is designed to run AI-driven code inside a Linux VM as an unprivileged user, utilizing seccomp filters and brokered mounts to manage untrusted workloads.
Ideally, any actions performed by the agent should remain confined to the guest VM and specifically selected folders. However, the SharedRoot chain reveals that this boundary is porous, converting what was presumed a safe coding environment into a gateway for host compromise.
Claude Cowork Sandbox Escape Flaw
The macOS Cowork app operates under the logged-in user, while it launches a Linux VM through Apple’s Virtualization framework.
Within this VM, the agent is placed in an unprivileged session account featuring a permissive seccomp profile. A critical vulnerability arises because the entire host filesystem is accessible within the VM through a virtiofs mount.
The exploitation begins when the session user creates a user namespace using the unshare command, effectively granting it capabilities akin to root privileges within that namespace.
This setup allows the agent to utilize the act_pedit kernel module via a netlink socket, actions permitted by the lenient seccomp filter, causing a vulnerable kernel module to autoload.
The pivotal vulnerability at the core of this exploit is identified as CVE‑2026‑46331, known as “pedit COW.” This publicly documented Ubuntu kernel flaw enables an attacker to corrupt the page cache of files they can access but not modify.
By exploiting this bug, the agent targets a root-owned binary, altering its in-memory cached image without affecting its on-disk version, thereby bypassing traditional integrity checks.
The root daemon, coworkd, eventually re-executes the compromised binary during regular operations, thus inheriting the malicious modifications while running as root.
Safeguards like NoNewPrivs do not mitigate privilege escalation in this context, as the executing process already possesses full root privileges.
After gaining root access within the guest VM, the agent can easily access the hidden filesystem mount, revealing the host’s root directory.
This access allows it to navigate the host user’s home directory, compromising SSH keys, cloud credentials, and other sensitive files, while also being able to create or modify files and configurations without user consent.
Researchers successfully executed this full exploit chain, demonstrating that a file written inside the supposed “sandbox” appeared in the host user’s home directory almost immediately.
This incident drastically undermines the foundational security claims of Cowork’s local execution model, highlighting that the issue extends beyond the specific kernel flaw to encompass significant design missteps.
