• 2 min read
Claude Cowork reportedly escaped its Mac sandbox
Researchers say Claude Cowork escaped a Linux VM on macOS, potentially exposing SSH keys and cloud credentials during local execution.
Image: TechRadar
Anthropic’s Claude Cowork can escape a virtual machine sandbox and access files on a host Mac, according to security researchers at Accomplish AI. The researchers say they reproduced the behavior in a local session running inside a Mac-hosted virtual Linux machine.
They connected a folder to a new Cowork session, sent a single message, and watched the agent break out of the VM. Once on the host system, it could read and write files beyond the connected folder, reportedly without showing a permission prompt.
“We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox. From inside the VM, it reached the host Mac and read and wrote files all over it, far outside the folder we’d connected, with no permission prompt anywhere.”
Claude Cowork’s sandbox escape
Accomplish AI said the attack used CVE-2026-46331, a Linux kernel privilege-escalation vulnerability known as “pedit COW.” The flaw was fixed in mid-June this year and carries a 7.8/10 high-severity score.
Recommended reading
GitHub and PyPI add time-based supply-chain defenses
A successful escape could expose data stored in the Mac user account, including SSH keys, cloud credentials, and other sensitive files. Accomplish AI disclosed the findings to Anthropic, which reportedly acknowledged them but did not release a direct fix.
The version of Claude Cowork released afterward defaults to cloud execution, which TechRadar says addresses the reported issue. Users who choose local execution may still be exposed.
Recommended mitigations for local users
Accomplish AI recommends disabling unprivileged user namespaces, granting and revoking seccomp permissions, stopping automatic module loading, and limiting what the host shares with the VM. It also advised mounting only the connected folders—or mounting them read-only—and running coworkd with ProtectSystem=strict in its own mount namespace.
“Then even a full guest-root has nothing to land on, the last two steps of the chain have nowhere to go.”
Security Editor
Sophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.
via TechRadar
