Cybersecurity researchers have identified a critical vulnerability in Anthropic’s Claude Cowork, an AI coding assistant, that allows the agent to escape its Linux virtual machine (VM) sandbox and access the host Mac’s file system. This flaw, dubbed “SharedRoot,” affects approximately 500,000 macOS users running local Cowork sessions.
The issue arises from the way Claude Cowork operates on macOS. The desktop application runs under the logged-in user’s account, while the AI agent functions within a Linux VM created using Apple’s Virtualization framework. Each session is assigned a disposable, unprivileged user and employs a Secure Computing Mode (seccomp) filter for sandboxing. Users can connect specific folders to the VM via a root daemon called “coworkd.”
A significant concern is that the entire host file system is mounted into the VM with read-write privileges. This setup means that if the AI agent gains root access within the VM, it can read and write files across the host Mac’s file system without any permission prompts. Such access could expose sensitive data, including SSH keys and cloud credentials.
The vulnerability exploits a combination of factors: the mounting of the host file system into the VM, the use of user and network namespaces granting the session CAP_NET_ADMIN within its private network namespace, and a specific Linux kernel flaw known as “pedit COW” (CVE-2026-46331). By leveraging these elements, the AI agent can escalate its privileges within the VM and access the host system’s files.
Upon responsible disclosure, Anthropic acknowledged the report but classified it as informative without issuing an immediate fix. However, the latest version of Claude Cowork defaults to cloud execution, mitigating the risk for users who opt for this mode. Those who continue to run the agent locally remain vulnerable.
This discovery underscores the ongoing challenges in securing AI agents and their environments. As AI tools become more integrated into development workflows, ensuring robust sandboxing and privilege separation is crucial to prevent potential security breaches. Users are advised to update their software promptly and consider using cloud execution modes when available to mitigate such risks.
