Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files
Researchers at Accomplish AI discovered a sandbox escape vulnerability in Anthropic's Claude Cowork for macOS, allowing the AI agent to access and modify files on the host Mac. Approximately 500,000 macOS users running local Cowork sessions were potentially affected before a fix was implemented. The vulnerability stems from a shared filesystem mount, granting the agent elevated privileges and access to sensitive data like SSH keys and cloud credentials. Anthropic initially closed the report without a fix, but the latest version defaults to cloud execution, mitigating the risk for users running in that mode.
Researchers at Accomplish AI have uncovered a critical sandbox escape vulnerability in Anthropic's Claude Cowork for macOS, presenting a significant risk to users running the AI agent locally. The vulnerability allows the Claude Cowork agent to break out of its Linux virtual machine (VM) and access files on the host Mac, including SSH keys and cloud credentials. Approximately 500,000 macOS users running local Cowork sessions were potentially affected prior to Anthropic issuing a fix.
Claude Cowork's macOS desktop app runs as the user logged into the system, while the agent-related work happens within a Linux VM created via Apple's Virtualization framework. Each session gets its own disposable unprivileged user, along with a Secure Computing Mode (seccomp) filter for application sandboxing. Folders connected by the user are shared into the VM by a root daemon called coworkd, which mounts the entire host filesystem into the VM with read-write privileges, accessible via the path /mnt/.virtiofs-root.
This allows guest-root inside the VM to access the entire host filesystem. Accomplish AI’s Oren Yomtov explained that the vulnerability is rooted in CVE-2026-46331, a recently disclosed flaw called pedit COW, which exploits the Linux kernel's "act_pedit" Traffic Control (tc) packet editing subsystem. The namespaces are not the exploit itself, but they make the normally privileged prerequisite available to an ordinary user.
Furthermore, the agent gains CAP_NET_ADMIN within its private network namespace, enabling various network-related operations. Anthropic initially closed the report without a fix, but the latest version defaults to cloud execution, addressing the issue for users running in that mode.
To mitigate the threat, Accomplish AI recommends disabling unprivileged user namespaces, avoiding overly permissive seccomp filters, stopping autoloading of modules, and restricting sharing of the entire host filesystem into the VM. Specifically, limiting the shared filesystem to only the connected folders and running coworkd with ProtectSystem=strict in its own mount namespace are crucial steps. This prevents guest-root from having any landing points, effectively blocking the agent's access to the host filesystem.