A recently disclosed vulnerability in the sandbox environment of Anthropic’s Claude Cowork has raised significant security concerns, primarily due to its potential to enable untrusted content processed by the AI agent to gain access to sensitive files stored on a macOS host. This flaw could expose a range of critical information, including SSH private keys, cloud credentials, and other sensitive data accessible to the logged-in user.
Oren Yomtov, a security researcher from Accomplish, has dubbed this particular attack methodology “SharedRoot.” He cautions that if a guest virtual machine (VM) is compromised, it could lead to a complete exposure of the host’s data. This risk emphasizes the importance of maintaining stringent security protocols, especially when operating AI technologies that interact with potentially harmful content.
### Claude Cowork Sandbox Escape Flaw
The architecture of Claude Cowork operates its agent workloads within a Linux virtual machine hosted on macOS. Within this framework, sessions are executed under a user with limited privileges, while certain user directories are integrated directly into the VM. However, the research indicates that the VM configuration inadvertently exposes the entirety of the host filesystem through a writable VirtioFS mount positioned at /mnt/.virtiofs-root. Although this mount was ostensibly meant to be available only to root users within the guest environment, Yomtov successfully showcased a technique that enables a session user to escalate their privileges to guest-root, thereby gaining access to the host’s filesystem.
The attack sequence initiates when an unprivileged user within the Cowork session employs the ‘unshare’ command to create a new Linux user namespace. This action inadvertently grants root-like capabilities within that namespace, including access to critical controls like CAP_NET_ADMIN. Disturbingly, the sandbox’s seccomp configuration reportedly permits this namespace operation and netlink sockets, thus allowing access to essential Linux traffic-control functions.
### Exploitation of Linux Kernel Vulnerability
The proof-of-concept exploitation revolves around CVE-2026-46331, a recognized vulnerability located within the Linux kernel, specifically impacting the act_pedit traffic-control module. This flaw is characterized as a “pedit COW” issue, potentially allowing an attacker to poison cached pages associated with read-only files. The report suggests that an attacker could aim to manipulate a root-owned helper binary that remains readable to the sandboxed user but is subsequently executed by the privileged coworkd service belonging to Cowork.
When the coerced root-owned service re-executes this compromised binary during its routine operations, the malicious version runs with root-level privileges inside the Linux VM. This circumvention of typical protections against privilege escalation occurs because the daemon in operation already possesses elevated privileges. Once the attacker achieves guest-root status, they gain access to the writable host filesystem mount, opening the door to further exploits.
With this level of access, it becomes feasible for attackers to read or alter files linked to the macOS user account. High-value targets include sensitive information such as SSH keys located in the ~/.ssh directory, AWS credentials stored in ~/.aws, cloud CLI tokens, source code repositories, browser data, API keys, and essential enterprise configuration files.
### Research Findings and Recommendations
During the course of their investigation, the researchers reported successfully executing the complete exploit chain on their systems. They demonstrated the ability to write a file from within the sandbox to the home directory of the host user, managing to exceed the restrictions imposed by the specific folder connection for Claude sessions.
Following the discovery, the researchers notified Anthropic, which subsequently classified the report as “Informative.” Anthropic’s evaluation was partly shaped by the recent public disclosure of the CVE and the context of its vulnerability-reporting window. In response to the identified risks, the company has transitioned its Cowork operations to default cloud execution. This move suggests a belief that the specific local VM escape vulnerabilities may not be applicable to cloud-hosted environments.
Nonetheless, the report asserts that the predominant risks arise from underlying architectural flaws, as opposed to merely being a consequence of CVE-2026-46331. The existence of unprivileged user namespaces, lenient seccomp regulations, autoloadable kernel modules, and a globally writable host filesystem share could conceivably allow future vulnerabilities in the Linux kernel to create similar exploit pathways.
To enhance security, recommended actions include disabling unprivileged user namespaces, blocking the use of commands like ‘unshare’ and ‘setns,’ along with namespace-creating clone operations and AF_NETLINK sockets through seccomp. Furthermore, organizations should prevent unused kernel modules, such as act_pedit, from autoloading and establish safeguards to ensure that privileged helper binaries remain unalterable through shared filesystem views. Lastly, the practice of file-sharing in virtual machines must be confined to explicitly approved directories, thereby refraining from exposing the entire host root filesystem as writable to guest environments.