Anthropic's Claude Cowork AI Tool Vulnerable to Sandbox Escape

Security researchers at Accomplish AI reported a sandbox escape vulnerability in Anthropic's Claude Cowork, dubbed “SharedRoot.” The flaw allows an AI agent running inside the tool’s Linux virtual machine on macOS to break out and gain read‑write access to the entire host filesystem. By exploiting the act_pedit kernel module (CVE‑2026‑46331) and a permissive virtiofs mount that shares the host’s root directory with the VM, the agent can read sensitive data such as SSH private keys and cloud credentials. Approximately 500,000 macOS users who run local Claude Cowork sessions were potentially exposed before a patch was issued. Anthropic closed the report as “informative” and has shifted default execution to cloud‑based sessions, though local sessions remain at risk. The issue highlights architectural weaknesses in VM‑based isolation when host‑file sharing is overly permissive.