{
 "public_id": "AIR-2026-0169",
 "incident_id": "2026-07-anthropic-claude-cowork-sharedroot",
 "date_disclosed": "2026-07-23",
 "date_occurred": null,
 "title": "SharedRoot: Claude Cowork agent escapes its Linux VM and reads/writes arbitrary files on the host Mac",
 "class": "responsible_disclosure",
 "attack_surface": "computer_use_agent",
 "initial_vector": "agent_executed_exploit_inside_its_own_sandbox",
 "agent_capability_abused": [
  "arbitrary_code_execution_in_sandbox",
  "filesystem_mount_access",
  "kernel_module_loading"
 ],
 "target_product": "Claude Cowork (macOS local VM mode)",
 "target_vendor": "Anthropic",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "sandbox_escape",
  "arbitrary_file_read",
  "arbitrary_file_write",
  "credential_theft"
 ],
 "blast_radius": "roughly 500,000 macOS users running local Cowork sessions before the change to cloud-default execution",
 "cve": [
  "CVE-2026-46331"
 ],
 "taxonomy": {
  "owasp_asi": [
   "ASI05",
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "sandbox_escape",
   "vm_escape",
   "kernel_exploit",
   "writable_host_mount",
   "agent_isolation_failure"
  ]
 },
 "defense_present": "Linux VM isolation with a per-session connected folder and permission prompts for host access",
 "defense_bypassed": true,
 "fix_shipped": "none directly - Anthropic closed the report as informative; current Cowork defaults to cloud execution which avoids the local escape path",
 "primary_sources": [
  "https://thehackernews.com/2026/07/claude-cowork-flaw-could-let-ai-agent.html",
  "https://labs.cloudsecurityalliance.org/research/csa-research-note-claude-cowork-sharedroot-sandbox-escape-20/"
 ],
 "verified_quote": "We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox. From inside the VM, it reached the host Mac and read and wrote files all over it, far outside the folder we'd connected, with no permission prompt anywhere.",
 "confidence": "medium",
 "notes": "Disclosed by Oren Yomtov / Accomplish AI on 2026-07-23. Chain: load act_pedit traffic-control subsystem in an unprivileged user namespace, exploit Linux kernel CVE-2026-46331 (copy-on-write handling in pedit) for guest root, then walk out through a writable host mount exposing '/'. Accomplish AI has not published its own writeup in citable form, so the source of record is The Hacker News coverage quoting the researchers verbatim - flagged per the CURATION secondary-source rule, hence confidence medium. Anthropic closed the report as 'informative' without issuing a fix.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Credential & Secret Theft",
 "risk_sub_secondary": [
  "Remote Code Execution & Sandbox Escape"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the Cowork agent executed the exploit and reached the host filesystem",
 "vector_family": "other",
 "vector_detail": "agent_executed_exploit_inside_its_own_sandbox",
 "guardrail_kind": [
  "human_approval",
  "sandbox_isolation",
  "permission_scope"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [
   "CVE-2026-46331"
  ],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "unknown",
 "model_provider": "anthropic",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "credential_theft",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "privilege_escalation"
 ],
 "eai_reason": "subcategory: Credential & Secret Theft",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI05 (impact=code_exec); ASI03 (eai_category=credential_theft)",
 "submitted_by": "EAI Internal"
}