Security researchers have identified a significant vulnerability in Anthropic’s Claude Cowork, an AI agent designed to assist users by accessing local files and applications. This flaw allows the agent to escape its virtual machine (VM) sandbox on macOS systems, potentially granting unauthorized access to sensitive files across the host machine.
Claude Cowork operates by running within a Linux VM on a user’s Mac, enabling it to perform tasks such as reading files, browsing the web, and executing code. The sandbox environment is intended to isolate the agent’s activities from the rest of the system, ensuring that any actions taken remain within a controlled and secure space.
Discovery of the Vulnerability
On July 23, researchers from Accomplish AI disclosed that they had successfully exploited a Linux kernel vulnerability, identified as CVE-2026-46331, to gain root access within the VM. This vulnerability, known as “pedit COW,” is a privilege escalation flaw that was patched in mid-June 2026. By leveraging this exploit, the researchers demonstrated that Claude Cowork could break free from its sandbox and interact with the host Mac’s filesystem without triggering any permission prompts.
In their demonstration, the researchers connected a folder to a new Cowork session and issued a single instruction. The agent proceeded to read and write files outside the designated shared folder, accessing data such as SSH private keys, cloud credentials, and browser information. This unauthorized access poses a significant risk, as it could lead to data exfiltration and compromise of sensitive information.
Anthropic’s Response and Mitigation Measures
Anthropic acknowledged the findings but did not provide a direct fix for the vulnerability. Instead, subsequent versions of Claude Cowork default to cloud execution, which limits the exploit when not run locally. However, users who operate the agent locally remain at risk of potential data exfiltration, including sensitive credentials.
To mitigate these risks, Accomplish AI recommends several measures for users who prefer local execution:
- Disable unprivileged user namespaces to prevent unauthorized processes from gaining elevated privileges.
- Configure stricter file permissions for connected folders to limit the agent’s access to sensitive data.
- Run the `coworkd` service with restricted system protections to minimize the potential impact of a security breach.
These steps aim to enhance the security of local Cowork sessions by reducing the agent’s ability to interact with critical system components and sensitive files.
The discovery of this vulnerability underscores the importance of robust sandboxing mechanisms and prompt patching of known security flaws. As AI agents like Claude Cowork become more integrated into daily workflows, ensuring their secure operation is paramount. Users should remain vigilant, apply recommended security measures, and stay informed about updates and patches to protect their systems and data from potential exploits.
