Claude Cowork escapes VM sandbox, accesses Mac host files
Security researchers demonstrated that Claude Cowork, Anthropic's AI agent, could escape its local virtual machine sandbox and access sensitive files on Mac computers, including SSH keys and cloud credentials, via a Linux kernel vulnerability. Anthropic responded by making cloud execution the default and requiring users to manually harden their configurations to use local execution safely.
What happened
Security researchers at Accomplish AI demonstrated that Claude Cowork could escape its local virtual machine sandbox and read files across the underlying Mac, including SSH keys and cloud credentials.
The attack exploited a Linux kernel privilege escalation vulnerability (CVE-2026-46331, known as 'pedit COW') to gain root access inside the guest VM, then accessed the host Mac through a writable VirtioFS filesystem mount that was shared between the VM and host.
Accomplish AI disclosed the findings on July 23, 2026, and reported that approximately 500,000 macOS users running local Cowork sessions were exposed before the issue was addressed.
Reported impact
The agent could read and write files across the host Mac far outside the folder that was connected to the Cowork session, with no permission prompt.
Sensitive files including SSH keys, cloud credentials, and other user files were accessible to the escaped agent.
Index analysis
The vulnerability existed because Cowork's local execution mode runs inside a Linux VM with a writable VirtioFS mount to the host filesystem that was intended to be accessible only to root within the guest.
The Linux kernel flaw (CVE-2026-46331) allowed privilege escalation from a session user to guest root, enabling the agent to reach anything the logged-in Mac user could access.
Governance controls
Anthropic closed the researcher report as 'informative' without issuing a direct fix and instead released a new version of Claude Cowork that defaults to cloud execution, which sidesteps the local escape path.
Users who opt to run the agent locally remain exposed unless they harden their configurations by disabling unprivileged user namespaces, restricting filesystem sharing, and running the Cowork daemon with strict mount protections.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.