Disclosed vulnerability
SharedRoot: Claude Cowork agent escapes its Linux VM and reads/writes arbitrary files on the host Mac
AIR-2026-0169 AIR record · 2026-07-anthropic-claude-cowork-sharedroot
From the supporting source
We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox. From inside the VM, it reached the host Mac and read and wrote files all over it, far outside the folder we'd connected, with no permission prompt anywhere.thehackernews.com
The record
Disclosed
2026-07-23
Vendor
Anthropic
Product
Claude Cowork (macOS local VM mode)
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation
System type
Generative model
Who acted
Agent acted — the Cowork agent executed the exploit and reached the host filesystem
Attack surface
Computer-use agent
Autonomy level
Semi-autonomous
Initial vector
Agent executed exploit inside its own sandbox
Impact type
Sandbox escape, Arbitrary file read, Arbitrary file write, Credential theft
Confidence
Medium
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
roughly 500,000 macOS users running local Cowork sessions before the change to cloud-default execution
Capability abused
Defense & remediation
Recorded defense
Linux VM isolation with a per-session connected folder and permission prompts for host access
Guardrail kinds
Human approval, Sandbox isolation, Permission scope
Guardrail outcome
Silent
Fix shipped
none directly - Anthropic closed the report as informative; current Cowork defaults to cloud execution which avoids the local escape path
Taxonomy & references
Curator notes
Disclosed by Oren Yomtov / Accomplish AI on 2026-07-23. Chain: load act_pedit traffic-control subsystem in an unprivileged user namespace, exploit Linux kernel CVE-2026-46331 (copy-on-write handling in pedit) for guest root, then walk out through a writable host mount exposing '/'. Accomplish AI has not published its own writeup in citable form, so the source of record is The Hacker News coverage quoting the researchers verbatim - flagged per the CURATION secondary-source rule, hence confidence medium. Anthropic closed the report as 'informative' without issuing a fix.
Supporting sources
Cite as
Enkrypt AI. "SharedRoot: Claude Cowork agent escapes its Linux VM and reads/writes arbitrary files on the host Mac". AIR, AIR-2026-0169. https://agentincident.vercel.app/i/AIR-2026-0169/ (accessed 2026-10-19).