SharedRoot: Claude Cowork's Agent Could Break Out of Its Virtual Machine to Reach Mac Files

Researchers at Accomplish AI have discovered a sandbox escape vulnerability in Claude Cowork — Anthropic's local AI agent for macOS. The flaw, given the codename SharedRoot, let the agent step outside the Linux virtual machine it runs inside and read or write files anywhere on the Mac. According to the researchers, before the fix was released the vulnerability exposed roughly 500,000 macOS users who ran local Cowork sessions.

“We attached a folder to a fresh Claude Cowork session, sent one short message — and watched the agent walk out of the sandbox,” said lead researcher Oren Yomtov. From the virtual machine the agent reached the host system and gained access to files well beyond the attached folder, and it did so without a single confirmation prompt.

How the escape works

The Cowork app runs the agent's actual work in a Linux VM created through Apple's Virtualization framework. Each session gets a single-use, unprivileged user and a seccomp filter. As it turned out, however, the root of the problem is that the entire host root “/” is mounted into the virtual machine with read and write permissions, accessible to the guest's root user at the path /mnt/.virtiofs-root.

To gain root inside the guest, the attack uses the Linux kernel's Traffic Control subsystem (the act_pedit module), loaded into an unprivileged user namespace, and exploits the recently disclosed vulnerability CVE-2026-46331 ("pedit COW"). Creating namespaces gives the session the CAP_NET_ADMIN capability, which is what opens access to the vulnerable path in the kernel. As Accomplish AI co-founder Or Hiltch put it, “namespaces aren't the exploit itself; they make a normally privileged precondition available to an ordinary user.”

Response and defense

After disclosure, Anthropic closed the report as “informational” without releasing a dedicated patch. At the same time, the latest version of Cowork does its work in the cloud by default, which sidesteps the issue — but anyone who deliberately runs the agent locally remains vulnerable.

The researchers stress the structural nature of the problem. “act_pedit is just one bug out of an entire category,” Yomtov notes. The kernel's net/sched subsystem regularly spawns vulnerabilities of the same shape: an auto-loadable module, a configuration path accessible to an unprivileged user, and a memory-handling bug at the end. “This isn't a problem you solve with faster patching. Structurally, you're always one bug behind.”

As defensive measures, they suggest disabling unprivileged namespaces, blocking module auto-loading, and — most importantly — restricting how the host is mounted into the VM: attach only the folders actually selected instead of all of “/”, or mount them read-only. Then even root obtained in the guest would be useless: the final links in the chain would simply have nowhere to land.

Source: The Hacker News