Security researchers have demonstrated a way for Anthropic’s Claude Cowork to escape its local safety environment on macOS and access files across the user’s Mac.
The attack, named SharedRoot, was disclosed by researchers at Accomplish AI on July 23. The findings were also reported by The Hacker News .
In testing, the researchers connected a folder to a fresh Claude Cowork session and sent a short instruction. They said the AI agent was then able to break out of its protected environment and read or write files outside the folder it had been given access to.
Those files could include sensitive information such as SSH keys, which are commonly used to securely access servers, and cloud credentials, which can provide access to online services and infrastructure.
When Claude Cowork runs locally on a Mac, its work takes place inside a Linux virtual machine, or VM.
A virtual machine is basically a separate computer running inside your real computer. It is designed to keep software isolated so that problems inside the VM do not affect the main Mac.
Claude normally runs inside this VM with limited permissions.
The problem discovered by Accomplish AI was that several weaknesses could be combined to give the agent much greater access than intended.
The researchers used a Linux kernel vulnerability called CVE-2026-46331, also known as pedit COW.
The Linux kernel is the central part of the operating system that controls hardware, memory, files, and permissions.
The flaw can allow a user with limited access to gain root privileges. Root is the highest level of permission in Linux. A root user can normally access and modify almost anything inside the system.
Kernel.org rates the vulnerability at 7.8 out of 10, placing it in the high-severity category.
Getting root access inside a virtual machine would normally still leave the attacker trapped inside that VM.
However, the researchers found that Claude Cowork’s local setup shared the Mac’s entire filesystem with the Linux VM through a writable mount.
A filesystem mount is simply a way of making files from one system available inside another. In this case, the Mac’s full filesystem was visible to the VM’s root user and could be modified.
Once the researchers gained root privileges inside the VM, they could access that shared filesystem and reach files belonging to the logged-in Mac user.
That meant the sandbox escape was no longer limited to Claude’s temporary environment.
Accomplish AI said its test allowed the agent to access files outside the folder originally shared with Claude without showing another permission request.
The researchers successfully reproduced the complete attack on their own machine.
They argued that the biggest problem was not only the Linux vulnerability itself, but the decision to expose the Mac’s entire filesystem to the virtual machine.
If only the folders selected by the user had been shared, gaining root access inside the VM would not necessarily have provided access to the rest of the Mac.
Accomplish AI reported the issue to Anthropic.
According to the researchers, Anthropic closed the submission as “Informative.”
Accomplish AI said the Linux vulnerability had been publicly disclosed within the previous 30 days, placing it outside the relevant scope of Anthropic’s bug bounty programme. Anthropic reportedly viewed the other proposed changes as additional security hardening rather than separate vulnerabilities.
Claude Cowork now runs sessions remotely on Anthropic’s servers by default.
Anthropic’s documentation says cloud execution is the standard option, while local execution remains available for existing desktop setups.
Accomplish AI said the SharedRoot escape does not appear to affect the cloud execution mode because the specific attack depended on the Linux VM running locally on the user’s Mac.
Reports have estimated that roughly 500,000 macOS users running local Cowork sessions may have been exposed before the change.
The research highlights a wider security problem as AI assistants gain the ability to work directly with files, applications and operating systems.
A chatbot that only generates text has limited access to the computer around it. An AI agent, however, can perform actions such as opening files, running programs and completing tasks on behalf of the user.
That makes the security barriers around the agent increasingly important.
In the SharedRoot case, Claude did not need to break every security layer individually. A Linux vulnerability provided the necessary permissions, while the way the host filesystem was shared turned a problem inside the VM into access to the wider Mac.
Accomplish AI argued that AI sandboxes should assume that attackers may eventually find a way to gain full control inside the VM. The protection between the VM and the actual computer should therefore remain strong even if that happens.
Get the latest tech news, telecom insights, and product launches wherever you prefer.
Add ProPakistani to Preferred Sources and see more of our stories in Google Search and Top Stories.
Shares
