Claude Cowork Security Flaw Exposes Mac Files via Sandbox Escape

Post Views: 13

Researchers identified a vulnerability in Anthropic’s Claude Cowork named SharedRoot that allowed an AI agent to bypass security restrictions and access files on a macOS device.

Vulnerability Overview

The flaw, which impacted approximately 500,000 users running local Cowork sessions prior to the service transitioning to cloud-based execution, enabled the AI to escape its isolated environment and interact with the host system.

Discovery and Scope

The vulnerability stemmed from the way the macOS application operated. While the AI agent executed tasks within a Linux virtual machine managed by Apple’s Virtualization framework, the host file system was mounted inside the guest environment with full read-and-write permissions.

Technical Details of the Flaw

This configuration, intended to restrict access to explicitly shared folders, instead granted the AI agent broader capabilities than designed. Security experts demonstrated the issue by linking a user-selected directory to a Cowork session and issuing a command.

File System Mounting Configuration

The AI agent successfully navigated beyond the shared folder, accessing the underlying macOS file system without triggering additional permission requests. This exposure could lead to the retrieval or modification of sensitive data, including SSH keys, cloud authentication tokens, and other user-specific files.

Exploitation and Impact

The attack vector relied on a Linux kernel flaw designated CVE-2026-46331, also known as pedit COW. This vulnerability exploited the kernel’s act_pedit traffic-control packet-editing subsystem and an unprivileged user namespace.

Kernel Flaw Exploitation

By leveraging user and network namespaces, the Cowork session gained access to the CAP_NET_ADMIN capability within its private network namespace. This allowed the AI to exploit the kernel flaw and achieve guest-root privileges, bypassing standard security barriers.

Anthropic’s Response and Mitigation

Once elevated, the agent could access the host file system mounted at /mnt/.virtiofs-root. From this location, it could traverse beyond the initially shared directory and interact with files across the entire macOS device.

Company Response and Current Status

Researchers emphasized that the flaw was not solely tied to the specific kernel vulnerability but also to the broader design of mounting the host file system within the virtual machine. Anthropic was notified of the issue, but the company classified the report as informational and did not issue a targeted patch.

Security Implications and Recommendations

The latest version of Claude Cowork now defaults to cloud-based execution, which mitigates the risk for users who opt for this mode. However, individuals who continue to use local sessions remain vulnerable to the underlying configuration flaw.

Mitigation Measures

Experts recommended mitigating measures such as restricting folder access to explicitly selected directories, mounting shared content in read-only mode, and isolating the coworkd service to minimize potential attack surfaces.

The incident underscores the security challenges posed by AI agents capable of interacting directly with host systems. Unlike traditional applications, these agents can execute commands, manipulate files, and make autonomous decisions within virtualized environments, highlighting the need for stricter separation between the agent’s workspace and the host operating system.