Mac Users Warned: Claude Cowork Flaw Let AI Agents Roam Free on Host System

A serious security gap in Anthropic's Claude Cowork tool left roughly half a million macOS users vulnerable to a sandbox escape that could let AI agents read or write files anywhere on the host machine. The flaw, tracked as SharedRoot, was uncovered by researchers at Accomplish AI and has since been patched in the latest version of the software, which now defaults to cloud execution.

The vulnerability stemmed from how the macOS desktop app handled file sharing. Claude Cowork runs AI agent tasks inside a Linux virtual machine created through Apple's Virtualization framework. When a user connected a folder, the entire host filesystem was mounted into that VM with read-write access, visible only to the guest-root user inside the VM. Accomplish AI's principal security researcher Oren Yomtov demonstrated that by sending a single message, the agent could escape the sandbox and access SSH keys, cloud credentials, and other sensitive data stored on the Mac.

To pull off the escape, the researchers exploited a known Linux kernel flaw called pedit COW (CVE-2026-46331) within the traffic control subsystem. By loading the vulnerable act_pedit module into an unprivileged user namespace, they gained guest-root privileges inside the VM. From there, the agent could roam the entire host filesystem without any permission prompts. Anthropic initially closed the report as informative before later addressing the issue through a default shift to cloud-based execution. However, users who choose to run Cowork locally remain exposed. The researchers recommend disabling unprivileged user namespaces, restricting seccomp filters, and limiting host filesystem sharing to only the folders a user explicitly connects - or at least mounting them read-only.

Source: The Hackers News