A significant security vulnerability has been identified in Claude Cowork’s local sandbox environment, enabling a malicious AI agent to escape its Linux virtual machine (VM) and access the host Mac’s filesystem. This breach allows unauthorized reading of sensitive information, such as SSH private keys and cloud credentials, without user prompts.
The issue arises from four design choices concerning the integration of the sandbox, kernel features, and the host filesystem. Security researchers from Accomplish have demonstrated an attack method named “SharedRoot,” which allows untrusted content within a Claude Cowork session to escape its VM and interact directly with the host macOS filesystem. By establishing a shared folder in a new Cowork session and using a crafted prompt, they showed the ability to read and write files across the host user’s account, exceeding the intended shared folder boundaries.
Understanding the Vulnerability
Claude Cowork is designed to run AI-driven code inside a Linux VM as an unprivileged user, utilizing seccomp filters and brokered mounts to manage untrusted workloads. Ideally, any actions performed by the agent should remain confined to the guest VM and specifically selected folders. However, the SharedRoot chain reveals that this boundary is porous, converting what was presumed a safe coding environment into a gateway for host compromise.
The macOS Cowork app operates under the logged-in user, while it launches a Linux VM through Apple’s Virtualization framework. Within this VM, the agent is placed in an unprivileged session account featuring a permissive seccomp profile. A critical vulnerability arises because the entire host filesystem is accessible within the VM through a virtiofs mount.
Exploitation Details
The exploitation begins when the session user creates a user namespace using the `unshare` command, effectively granting it capabilities akin to root privileges within that namespace. This setup allows the agent to utilize the act_pedit kernel module via a netlink socket, actions permitted by the lenient seccomp filter, causing a vulnerable kernel module to autoload.
The pivotal vulnerability at the core of this exploit is identified as CVE‑2026‑46331, known as “pedit COW.” This publicly documented Ubuntu kernel flaw enables an attacker to corrupt the page cache of files they can access but not modify. By exploiting this bug, the agent targets a root-owned binary, altering its in-memory cached image without affecting its on-disk version, thereby bypassing traditional integrity checks.
The root daemon, coworkd, eventually re-executes the compromised binary during regular operations, thus inheriting the malicious modifications while running as root. Safeguards like NoNewPrivs do not mitigate privilege escalation in this context, as the executing process already possesses full root privileges.
After gaining root access within the guest VM, the agent can manipulate the virtiofs mount to access the host filesystem. This access allows the agent to read sensitive files, including SSH private keys and cloud credentials, without any user prompts or notifications.
This vulnerability underscores the critical importance of robust sandboxing mechanisms in AI development environments. As AI tools become more integrated into development workflows, ensuring that sandbox environments are secure and isolated from host systems is paramount. Developers and organizations using Claude Cowork should apply any available patches promptly and review their security configurations to mitigate potential risks.
