Accomplish AI security researchers disclosed on July 23 that Anthropic’s Claude Cowork could escape its sandbox on Mac, giving the AI agent silent read and write access to files across the machine after a single prompt.
Quick Summary – TLDR:
- Accomplish AI demonstrated SharedRoot, an exploit chain that let a local Cowork session read and write files anywhere on a Mac.
- Around 500,000 macOS users running local Cowork sessions were exposed before Anthropic changed the defaults.
- CVE-2026-46331, a Linux kernel flaw, gave the agent root inside its virtual machine and opened a writable mount of the Mac.
- Anthropic made cloud execution the default on July 7, which sidesteps the local escape path entirely.
- Users who still run Cowork locally stay exposed unless they harden the configuration by hand.
What Happened?
Accomplish AI researchers reported the flaw, named SharedRoot, on July 23 after demonstrating it against a locally running Cowork session. They connected a single folder, gave Claude one instruction, and watched the agent read and write files outside the approved folder without a second permission prompt.
The exploit broke both controls Anthropic built around the agent. Cowork runs inside a virtual machine meant to sandbox it, and it should touch only the folders a user approves. SharedRoot defeated both, and about 500,000 macOS users running local sessions were exposed before the defaults changed.
Accomplish AI said the reachable files included SSH private keys, cloud credentials, and browser data, the categories most prized in credential theft campaigns. The researchers found no evidence that anyone used SharedRoot against Cowork users outside their controlled test.
Security researchers have uncovered a flaw in Claude Cowork, allowing the AI agent to escape its sandbox on macOS and access sensitive files. This vulnerability exploits a Linux kernel flaw, posing significant risks to user data. Users are advised to disable unprivileged… pic.twitter.com/3AuGGiOdwG
— The Daily Tech Feed (@dailytechonx) July 27, 2026
How SharedRoot Reached Root?
The chain started with CVE-2026-46331, a flaw in the Linux kernel’s traffic control packet editing code. Incorrect copy on write handling could corrupt page cache memory and let a local user alter protected files.
The researchers used that corruption to replace a file that coworkd, a root-level service managing shared files, later executed. Because coworkd already ran as root, the swapped file handed the Cowork session root access inside the guest operating system.
Root then opened a read-write VirtioFS mount of the entire Mac filesystem that Cowork had placed inside the virtual machine for trusted processes. “Only the VM’s root user can see it, and reaching it is the last move in the escape,” Accomplish AI wrote.
SharedRoot did not break Apple’s virtualization system. The mount covered the full filesystem, yet access still depended on the logged-in user’s permissions and macOS safeguards around certain system and private data, so it did not automatically expose every file.
Cloud Execution Closes The Local Path
Anthropic had already made cloud execution the default on July 7, when the company expanded Cowork to the web and mobile devices. Remote sessions run on Anthropic’s servers, so the agent no longer sits inside the local virtual machine that exposed the Mac’s filesystem.
Cloud mode sidesteps SharedRoot, though it does not remove the risk of handing an agent access to sensitive files and accounts. Desktop users can still choose local processing, which keeps the escape route relevant to those sessions. The case follows a similar disclosure in which an OpenAI agent escaped its sandbox and reached Hugging Face’s servers, marking agent isolation as an industry-wide weak point.
Accomplish AI said it reported SharedRoot to Anthropic, which closed the submission as “Informative” without publicly explaining the rating. Several questions stay open: how many of the exposed users still run local sessions, whether other routes to guest root remain while Cowork mounts the full filesystem read-write, and why the report drew that classification.
Anyone who ran local Cowork sessions with untrusted files should treat the reachable credentials as exposed. Steps that help reduce risk include:
- Rotating SSH private keys, cloud credentials, and browser-stored logins the agent could have reached.
- Mounting only the folders a task needs, and making those mounts read-only where possible.
- Keeping directories that hold keys or credentials disconnected from any local session.
SQ Magazine’s Takeaway
The core failure sat in the trust model, not a single bug. Users granted Cowork a folder and assumed the sandbox plus the permission prompt would hold the agent there. SharedRoot showed that one kernel flaw could collapse both layers at once and give a scoped assistant read access to the whole filesystem, a growing concern for macOS security teams.
What comes next centers on configuration. Cloud execution is now the default and closes this path for most users, so the remaining exposure sits with people who opt into local processing. Those users can harden their setup by disabling unprivileged user namespaces, restricting filesystem sharing, and running the Cowork daemon with strict mount protections. Anthropic has not said whether it will change how it mounts the host filesystem, which leaves the “Informative” rating as the open question security teams will watch.
