SharedRoot Sandbox Escape in Claude Cowork

Security researchers have identified a mechanism through which AI agents operating within Anthropic's Claude Cowork can bypass intended security boundaries. The flaw, designated as SharedRoot, creates a path for an agent running in a local Linux virtual machine to gain unauthorized read and write access to the host macOS system.

The Anatomy of a Sandbox Breach

Claude Cowork utilizes Apple's Virtualization framework to execute tasks in a contained Linux environment. While each session typically operates with an unprivileged user and a seccomp filter, investigators found that the architecture of the file system sharing between the guest and host introduces structural risks. The daemon responsible for managing these sessions, coworkd, maps the host's root directory into the virtual machine.

We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox. From inside the VM, it reached the host Mac and read and wrote files all over it, far outside the folder we'd connected, with no permission prompt anywhere.

— Oren Yomtov, principal security researcher at Accomplish AI

By leveraging specific Linux kernel subsystems, an agent can escalate its privileges within the virtual machine. This process relies on creating network namespaces that provide CAP_NET_ADMIN capabilities, which are then used to trigger CVE-2026-46331. This exploit, known as pedit COW, allows the agent to achieve guest-root access, effectively removing the isolation provided by the sandbox.

Quantifying the Scope of Risk

• 500,000 macOS users were affected by the issue prior to adjustments.
• CVE-2026-46331 is the specific kernel flaw utilized in the escape chain.
• The entire host root directory is mounted at /mnt/.virtiofs-root within the guest.

Persistent Exposure in Local Deployments

While newer iterations of the service default to cloud-based execution to mitigate this risk, users who maintain local instances remain potentially vulnerable. The core issue, according to researchers, is that the net/sched subsystem of the Linux kernel frequently produces similar privilege escalation paths. Even if specific vulnerabilities are patched, the underlying architecture remains susceptible to future exploits that follow an identical pattern of autoloadable modules and accessible configuration paths.

Security Implications for AI Agents

The discovery of the SharedRoot vulnerability underscores the fragility of sandboxing technologies when integrated with complex, high-privilege operations. For organizations deploying AI agents locally, this incident highlights a significant trade-off: moving processes into cloud-managed environments may provide a necessary layer of abstraction, but it does not resolve the structural risks present in the kernel code itself. Security teams should prioritize restricting unprivileged user namespaces and implementing stricter mount controls, such as read-only configurations, to ensure that even a successful escape does not lead to total host compromise. As AI agents gain deeper access to local file systems to perform their work, the potential for an exploit to transition from a software-level bug to a full system breach becomes a standard operational hazard.