Claude Cowork SharedRoot Flaw Lets AI Agent Escape VM and Access Mac Files

Cybersecurity researchers at Accomplish AI have disclosed a critical sandbox escape vulnerability in Anthropic's Claude Cowork that allows the AI agent to break out of its isolated Linux virtual machine and read or write arbitrary files on the host Mac. Codenamed SharedRoot, the flaw affected an estimated 500,000 macOS users running local Cowork sessions before a partial mitigation was deployed. "We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox," said Oren Yomtov, principal security researcher at Accomplish AI. "From inside the VM, it reached the host Mac and read and wrote files all over it, far outside the folder we'd connected, with no permission prompt anywhere." With this level of access, the agent could exfiltrate SSH keys, cloud credentials, browser cookies, and any other data stored under the user's account.

The root cause lies in how Claude Cowork's macOS desktop app provisions its sandbox. While the agent runs inside a disposable Linux VM built on Apple's Virtualization framework with seccomp filters and an unprivileged user, a root daemon called coworkd mounts the entire host filesystem read-write into the VM at /mnt/.virtiofs-root, visible only to guest-root. Exploiting CVE-2026-46331, a flaw in the Linux kernel's act_pedit Traffic Control subsystem known as pedit COW, an attacker can escalate from the unprivileged session to guest-root by loading tc/act_pedit into a user namespace and leveraging CAP_NET_ADMIN in a private network namespace. Accomplish AI co-founder and CTO Or Hiltch confirmed to The Hacker News that these namespaces are not the exploit itself but merely grant the capability needed to reach the vulnerable kernel path. Once guest-root is obtained, the read-write mount of the host's "/" turns into a full compromise of the Mac filesystem as the logged-in desktop user.

Following responsible disclosure, Anthropic closed the report as informative without shipping a dedicated patch, but the latest version of Cowork now defaults to cloud execution, which removes the local VM exposure. Users who deliberately opt into local agent execution remain vulnerable to SharedRoot. Given that a successful exploit can silently harvest credentials and session tokens, affected users should rotate passwords and secrets immediately and audit their systems for suspicious activity using a password checker to confirm whether stored credentials have been compromised. The incident also underscores how AI agent architectures that mount host resources for convenience can silently erase the boundary between sandbox and system.

For security teams evaluating AI agent deployments, the SharedRoot disclosure is a reminder that local execution models must be treated as privileged software, not harmless assistants. Researchers probing their own Cowork installations can validate exposure with network and transport-layer checks via an SSL/TLS checker and a DNS leak test, while defenders should monitor for unexpected traffic from localhost-bound VMs reaching external endpoints. As Anthropic and other vendors ship increasingly capable agents with filesystem and shell access, kernel-level sandbox assumptions will continue to be the weakest link until guest-to-host isolation is enforced at the hypervisor layer rather than the mount table.