Security researchers have identified a critical vulnerability in Anthropic’s Claude Cowork, an AI assistant designed to perform tasks by accessing local files on a user’s Mac. This flaw, termed ‘SharedRoot,’ enables the AI to bypass its sandbox environment, granting it unrestricted access to all files on the host system.
Claude Cowork operates within a virtual machine (VM) to isolate its processes and is intended to access only user-specified files and folders. However, researchers from Accomplish AI discovered that a simple command could allow the AI to escape this confinement, providing it with the ability to read and write across the entire Mac filesystem without triggering any permission prompts.
The implications of this vulnerability are severe. An attacker exploiting this flaw could access sensitive information, including SSH private keys and cloud service credentials, potentially compromising the user’s online accounts and personal data.
Approximately 500,000 macOS users running local Cowork sessions were affected before Anthropic addressed the issue. In response, the company released an updated version of Claude Cowork that defaults to cloud execution, effectively mitigating the local escape vector. However, users who continue to run the agent locally remain at risk unless they implement specific security measures, such as disabling unprivileged user namespaces, restricting filesystem sharing, and enforcing strict mount protections for the Cowork daemon.
This incident underscores the challenges in securing AI agents that require deep integration with local systems. As AI tools become more embedded in daily workflows, ensuring robust security measures and prompt vulnerability management is crucial to protect user data and maintain trust in these technologies.
