[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwC6-XKa3fOghbqeUBOLQ9F9vAxYprA6SjrHIpiBjc6I":3},{"article":4,"iocs":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":30,"category":31,"article_tags":35},"b1203f61-3735-46e6-987a-1626f39c531a","Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files","claude-cowork-flaw-could-let-ai-agent-escape-its-vm-and-access-mac-files-e15998","Cybersecurity researchers have uncovered a sandbox escape vulnerability in Anthropic's Claude Cowork that makes it possible to break out of the confines of a Linux virtual machine (VM) within which the agent runs to read or write files anywhere on the Mac. Accomplish AI, which shared details of the vulnerability with The Hacker News ahead of publication, said about 500,000 macOS users running","A sandbox escape vulnerability in Anthropic's Claude Cowork allows AI agents running in a Linux VM to access and modify files on the host macOS. Researchers exploited a Linux kernel flaw (CVE-2026-46331) to gain root access within the VM, enabling it to read sensitive data like SSH keys and cloud credentials. While Anthropic closed the report as informative, newer versions default to cloud execution, mitigating the risk for those users.","Claude Cowork flaw allows AI agent to escape VM and access Mac files.","Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files Ravie LakshmananJul 23, 2026Vulnerability \u002F Application Security Cybersecurity researchers have uncovered a sandbox escape vulnerability in Anthropic's Claude Cowork that makes it possible to break out of the confines of a Linux virtual machine (VM) within which the agent runs to read or write files anywhere on the Mac. Accomplish AI, which shared details of the vulnerability with The Hacker News ahead of publication, said about 500,000 macOS users running local Cowork sessions were affected prior to it being patched. It has been codenamed SharedRoot. \"We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox,\" Oren Yomtov, principal security researcher at Accomplish AI, said. \"From inside the VM, it reached the host Mac and read and wrote files all over it, far outside the folder we'd connected, with no permission prompt anywhere.\" With this level of access, the agent can access any data stored on the Mac via the user's account, including SSH keys, cloud credentials, and other valuable information. Following responsible disclosure, Anthropic closed the report as informative without issuing a fix. That said, the latest version of Cowork defaults to cloud execution, which addresses the issue. But users who opt to run the agent locally are still exposed to the problem. Claude Cowork's macOS desktop app runs as the user who is logged into the system. The actual agent-related work, on the other hand, happens in a Linux VM created via Apple's Virtualization framework. Every session gets its own disposable unprivileged user, along with a Secure Computing Mode (seccomp) filter for application sandboxing. The folders connected by the user are shared into the VM by a root daemon called coworkd. \"One detail matters more than the rest: the host filesystem gets shared into that VM read-write,\" Yomtov explained. \"The entire host '\u002F,' mounted so that only guest-root inside the VM can see it, at \u002Fmnt\u002F.virtiofs-root.\" Because the entire host file system is mounted into the agent's VM with read-write privileges, any path to guest-root can grant the agent access to the underlying host, effectively escaping the sandbox. This involves loading the Linux kernel's \"act_pedit\" Traffic Control (tc) packet editing subsystem into an unprivileged user namespace and exploiting CVE-2026-46331 in the guest kernel, a recently disclosed flaw called pedit COW, to obtain guest-root. From there, the agent can access the whole host (\"\u002F\") with elevated privileges, allowing it to read or write files from and to the Mac's file system as the logged-in desktop user. Or Hiltch, co-founder and CTO of Accomplish AI, told The Hacker News that creating user and network namespaces gives the session CAP_NET_ADMIN within its private network namespace, allowing it to perform various network-related operations. \"That capability provides access to the vulnerable tc\u002Fact_pedit kernel path used by pedit COW,\" Hiltch added. \"The namespaces are not the exploit; they make its normally privileged prerequisite available to an ordinary user.\" The development assumes significance in the face of revelations that OpenAI's models managed to break out of its sandboxed environment during a security test that resulted in the breach of Hugging Face's production infrastructure in their quest to cheat the ExploitGym benchmark they were being graded on. \"act_pedit is one bug in a category,\" Yomtov said. \"The Linux net\u002Fsched subsystem throws off this exact shape of privilege escalation on a regular cadence: an autoloadable module, a config path an unprivileged user can reach, a memory bug at the end of it. Patch this one and you've fixed this one. The chain re-arms on the next one, with everything above the kernel untouched.\" \"And the next one is always coming. At any given moment there's likely a privilege-escalation bug it's still exposed to, sometimes fixed upstream but not yet in your image, sometimes not yet fixed anywhere, with a working exploit out within hours. This isn't a patch-faster problem. You're structurally one bug behind, all the time.\" To mitigate the threat, it's essential to disable unprivileged user namespaces, avoid making the seccomp filter overly permissive, stop autoloading of modules, and restrict sharing of the whole host into the VM. \"Scope it to the folders that were actually connected instead of all of \u002F, or at least mount it read-only, and run coworkd with ProtectSystem=strict in its own mount namespace so it isn't re-execing binaries a session user can poison,\" Accomplish said. \"Then even a full guest-root has nothing to land on, the last two steps of the chain have nowhere to go.\" Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  AI Security, Application Security, Data Exposure, endpoint security, linux, MacOS, privilege escalation, Sandbox Escape, Virtualization, Vulnerability ⚡ Top Stories This Week URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365 Meta Files Patent for AI That Can Listen All Day and Track How You're Feeling New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials 11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development Unpatched Shark Vacuum Flaw Could Let Attackers Control Other Vacuums Region-Wide New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories E.U. Orders Google to Open Android Mic, Camera and Screen to Rival AI Assistants OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code ⭐ Featured Resources What Security Teams Must Defend in the New AI Software Supply Chain Identity Fraud Is Changing Fast. See the Attacks Businesses Face in 2026 What 25 Million Alerts Reveal About the Threats SOCs Ignore How to Find and Control Every Script Running Through Your Marketing Stack Modern SASE Guide: Close the Gaps Traditional Network Security Cannot See","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fclaude-cowork-flaw-could-let-ai-agent.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhj5Vr8pje9uM-Ce6rzE-_hhU3HvR2NkKtYfaSrIXz3m0BbrC1ZNC9p4GW4GRQaAvFKPjE5kopXmdmcKcMb7_1dbOWvMO6_oe87HCj4TUXV1dWK99cz_OBcNHd81Ziat93g4wJcBdc3K1vq0IkwFL9DO9GlSrf_KxGi2hpg7VVsU9iTt7B2XByXL7nil86i\u002Fs1600\u002Fclaude.gif","2026-07-23T13:27:59+00:00","2026-07-23T16:00:28.559031+00:00",8,[18,21,24,27],{"name":19,"type":20},"Claude Cowork","product",{"name":22,"type":23},"Anthropic","vendor",{"name":25,"type":26},"Virtualization framework","technology",{"name":28,"type":29},"Accomplish AI","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,38,43],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[49],{"type":50,"value":51,"context":52},"cve","CVE-2026-46331","Linux kernel flaw exploited in the sandbox escape."]