SharedRoot Flaw in Claude Cowork Exposed Entire Mac Disk

Accomplish AI, a security research firm, disclosed a vulnerability in Claude Cowork, Anthropic's tool for running AI agents on Mac computers. A single short message sent to a freshly started session was enough for the agent to escape its isolated virtual machine and gain full read and write access to files on the host, beyond the folder the user had shared with it.

How the attack worked

Claude Cowork runs agent work inside a Linux virtual machine created by Apple's virtualization framework. In theory, this isolation was meant to protect the user's computer from whatever the agent did while carrying out tasks. In practice, researchers at Accomplish AI found a six-step chain that bypassed that isolation almost entirely.

The VM's session user could first call the unshare function to gain root privileges within its own namespace. With CAP_NET_ADMIN in hand, it could then configure network traffic using the act_pedit module, which loaded into the kernel automatically. That opened the door to exploiting CVE-2026-46331, which allowed an attacker to poison the guest kernel's page cache.

The next step was escalating to full root privileges inside the virtual machine, when the coworkd daemon re-executed binaries that had already been compromised. From there, a straightforward path led to /mnt/.virtiofs-root, the point where the entire macOS host file system was mounted read-write.

We attached a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox - Oren Yomtov, lead security researcher, Accomplish AI

Four flaws at once

Accomplish AI stresses that no single bug would have been enough to carry out the attack, were it not for the convergence of four independent design decisions: unprivileged user namespaces left enabled, an overly permissive seccomp filter operating on a default-allow basis, no block on automatic loading of kernel modules such as act_pedit, and the entire host file system mounted read-write inside the virtual machine.

Each of these elements on its own would have broken the attack chain. Together, they formed a path that could be walked with a single text message, with no user consent prompt at any point during the privilege escalation.

Anthropic's response

The report reached Anthropic before publication, following standard responsible disclosure procedure. The company closed it with an informational label, however, without issuing a separate fix for local agent execution mode. Instead, the latest version of Claude Cowork now shifts agent task execution to the cloud by default, which in practice eliminates this specific attack vector for new installations.

Users who deliberately choose to run the agent locally on their own machine, however, remain exposed. The researchers note that the problem extends beyond a single product and reflects a broader trend of running increasingly autonomous AI agents with file system access without full certainty about the boundaries of the isolation they operate within.

What it means for developers

The SharedRoot case fits into a recent string of findings showing that the sandboxes isolating coding agents can be leakier than their creators assume. The SSH keys and cloud credentials the attacker could access are exactly the kind of resources whose exposure lets attackers take over further systems down the software supply chain.

For companies using tools like Cowork, this means the isolation label alone isn't enough to satisfy a security audit. Companies should verify whether an agent running locally has access only to the designated folder, or, as in this case, to the entire disk through an unpatched gap in the virtualization configuration.

The Linux kernel vulnerability CVE-2026-46331 underlying the attack is also a reminder that container and VM security depends on how fast the kernel itself gets patched. As the researchers note, for privileged containers, systems remain, in practice, always one vulnerability behind.