Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files

A security flaw in Anthropic’s Claude Cowork could allow an AI agent running inside a Linux virtual machine to escape its sandbox and access files across a user’s Mac, according to researchers who disclosed the issue this week.

Accomplish AI researchers said the vulnerability chain, which they named SharedRoot, combined a Linux kernel privilege escalation flaw with Claude Cowork’s architecture for sharing files between the virtual machine and the host system. The researchers said they were able to move from the isolated environment into the underlying Mac without triggering a permission prompt.

The flaw affected local Cowork sessions before Anthropic changed the product’s default execution model, according to Accomplish AI. The company said the issue was disclosed to Anthropic through responsible channels.

Researchers Demonstrate Claude Cowork Vm Escape Chain

Accomplish AI principal security researcher Oren Yomtov said the attack required only a short message sent to a fresh Claude Cowork session after connecting a folder.

“We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox,” Yomtov said.

“From inside the VM, it reached the host Mac and read and wrote files all over it, far outside the folder we’d connected, with no permission prompt anywhere,” he added.

According to the researchers, successful exploitation could allow an attacker to access files available to the logged-in macOS user, including sensitive data such as SSH keys and cloud credentials.

Claude Cowork runs AI tasks inside a Linux virtual machine created through Apple’s Virtualization framework. The desktop application runs with the permissions of the logged-in user, while agent workloads execute inside a separate VM environment.

The security boundary relied on keeping the VM isolated from the host operating system.

Exploit Used Linux Kernel Vulnerability To Gain Guest Root Access

The SharedRoot chain relied on CVE-2026-46331, a Linux kernel vulnerability affecting the “act_pedit” traffic control subsystem, according to Accomplish AI.

Researchers said the flaw allowed an unprivileged user inside the VM to gain root-level access within the guest environment. From there, the agent could reach a mounted copy of the host filesystem exposed inside the virtual machine.

The researchers said Claude Cowork’s file-sharing design was a critical part of the chain because the host filesystem was mounted with read-write access.

“One detail matters more than the rest: the host filesystem gets shared into that VM read-write,” Yomtov said.

“The entire host ‘/’, mounted so that only guest-root inside the VM can see it, at /mnt/.virtiofs-root,” he added.

Accomplish AI said the issue was not caused solely by the Linux kernel vulnerability. Instead, the researchers said the exploit required the combination of the kernel flaw, the VM configuration and the way host files were exposed to the guest environment.

Anthropic Changed Cowork Defaults After Disclosure

Anthropic did not issue a traditional security fix for the reported issue, according to Accomplish AI, which said the company classified the report as informational.

However, the latest version of Claude Cowork defaults to cloud execution rather than local execution, reducing exposure to the specific attack path described by researchers.

Users who continue running local Cowork sessions may still be affected depending on their configuration, according to Accomplish AI.

The company recommended limiting host filesystem access, avoiding read-write mounts of broad system paths and restricting privileges available inside local AI agent environments.

Ai Agents Create New Security Challenges For Local Systems

The Claude Cowork vulnerability comes as AI assistants increasingly gain access to local files, software tools and operating system resources.

Unlike traditional applications that perform fixed tasks, AI agents are designed to interpret instructions and interact with multiple systems on behalf of users. Security researchers have increasingly focused on how those permissions are isolated and controlled.

Accomplish AI researchers said the SharedRoot chain highlights risks created when an AI agent environment has access to broad host resources.

“act_pedit is one bug in a category,” Yomtov said. “The Linux net/sched subsystem throws off this exact shape of privilege escalation on a regular cadence.”

The researchers said preventing similar attacks requires limiting the systems available to AI agents, including reducing unnecessary filesystem access and tightening sandbox boundaries.

Anthropic has not publicly confirmed the vulnerability details described by Accomplish AI.