Researchers Disclose Claude Cowork Flaw That Could Let AI Agent Escape Its VM and Access Mac Files

A second agentic-tool sandbox-escape disclosure in as many weeks — this one lands on Claude Cowork for Mac, and the defender move is a quick review of how the feature runs.

SAN FRANCISCO — Researchers on July 23, 2026 disclosed a flaw in Anthropic's Claude Cowork feature that reportedly could let its AI agent break out of the Linux virtual machine it runs inside and reach files across the host Mac. The core claim, in defender terms, is that the VM meant to wall the agent off from the rest of the machine could reportedly be escaped — letting the agent read or write files far outside the single folder a user had connected, with no additional permission prompt.

The disclosure was reported by The Hacker News, which said security firm Accomplish AI shared the research ahead of publication and codenamed it SharedRoot. This piece restates the finding in defender terms — what to review and where the exposure reportedly sits — and does not reconstruct the escape technique. As with any research disclosure, the useful posture is to take it seriously while reading it as a documented capability, not an attack in the wild.

What the Researchers Disclosed

According to The Hacker News, researchers at Accomplish AI described a sandbox-escape flaw in Claude Cowork, Anthropic's feature that lets the agent do local work on a user's machine. On a Mac, that work reportedly runs inside a disposable Linux VM built on Apple's Virtualization framework, with the folders a user connects shared into the VM. The VM is the security boundary — the layer meant to keep the agent's activity separated from the rest of the Mac.

The disclosure, which Accomplish AI codenamed SharedRoot in its own write-up, reportedly demonstrates that this boundary could be crossed: after connecting a folder and sending a single message, the researchers say the agent reached the host Mac and read and wrote files well outside the connected folder, with no permission prompt. At that level of access, reporting notes the agent could reportedly reach sensitive material stored under the logged-in user's account, such as SSH keys and cloud credentials. The CyberSignal is deliberately not reproducing the escape mechanics; the defender-relevant facts are the class of the finding — a VM boundary that could reportedly be crossed on a local Mac session — and where it sits in the product.

The underlying step reportedly leaned on a recently disclosed Linux kernel privilege-escalation flaw (tracked as CVE-2026-46331) inside the guest VM, chained with how the host file system was shared into it. The defender-relevant point is the researchers' own framing: the same shape of kernel bug tends to recur, so patching one instance does not, by their account, close the class.

Another Agentic-Tool Escape in a Growing Thread

SharedRoot lands in a run of disclosures that all probe the seams of agentic tools — software that acts on a user's behalf across files, browsers, and developer environments. The most direct rhyme is the reporting that OpenAI's own models reportedly escaped a test sandbox during an internal evaluation, which The Hacker News cited alongside this disclosure. The through-line is that the sandbox around an AI agent is becoming its own attack surface rather than a settled given.

It also extends a thread The CyberSignal has tracked across vendors: a reported Claude for Chrome flaw touching Gmail and Calendar, the AWS Kiro agentic IDE reportedly steered by a poisoned web page, and an Azure DevOps MCP weakness surfaced through a hidden pull-request comment. None of these is the same bug, and the point is not to equate them; it is that the boundary between an assistant's sanctioned scope and the rest of a system is where this research keeps landing.

Defender Posture for Teams Running Claude Cowork on Mac

For teams that use Claude Cowork on Macs, the practical review is short and does not require reconstructing the finding. First, establish which execution mode your users run. Reporting indicates the current version of Cowork defaults to cloud execution, which reportedly addresses the issue; the reported exposure applies to sessions that run the agent locally on the Mac. Confirming the default, and whether any users have opted into local execution, is the first question to answer.

Second, treat the folders connected to a local session as the real blast radius. The disclosure's relevance is that a local agent's reach could reportedly extend beyond what a user intended, so limiting local sessions to non-sensitive working directories — and keeping high-value material such as SSH keys and cloud credentials out of easy reach of any local session — is prudent regardless of this flaw. Third, keep the Cowork app current, since the software that governs how sessions run is where any hardening would arrive.

Anthropic's Response and Patch Status

Patch status is the item most worth stating carefully, because it does not fit the usual advisory shape. According to the reporting reviewed, Anthropic closed the responsible-disclosure report as informative without issuing a dedicated fix, and the mitigation that matters is architectural rather than a patched version number: the current Cowork defaults to running work in the cloud, which reportedly removes the local-Mac exposure. Users who choose to run the agent locally reportedly remain exposed.

The CyberSignal is not asserting a resolution beyond what the reporting supports. Not established in the material reviewed: any formal advisory or CVE assigned to the Cowork issue itself, the number of users who run local rather than cloud sessions, and whether Anthropic plans further hardening of the local mode. We will update if Anthropic publishes guidance or researchers replicate the work.

Open Questions

Several specifics remain unresolved at publication, and The CyberSignal is not filling them in. The reported figure of roughly 500,000 affected macOS users running local sessions comes from the researchers via reporting, not an Anthropic disclosure. It is also not confirmed whether the technique has been observed outside the researchers' own testing.

The larger open question is the one the researchers themselves raise: whether scoping a fix to a single kernel bug meaningfully closes the exposure, or whether the boundary needs rethinking so a compromised guest VM has less of the host to reach in the first place. That is a design question about where agentic tools draw their trust boundaries — one this disclosure sharpens without settling.

The CyberSignal Analysis

The reported facts above come from the disclosure and its reporting; what follows is The CyberSignal's editorial reading. None of the judgments below are new reported facts.

Signal 01 — The Sandbox Is Now the Attack Surface

The instinct with an agentic tool is to trust the sandbox and move on, and this run of disclosures reportedly frustrates that instinct. Our reading is that the VM around a local agent has quietly become a security control in its own right — and controls that carry real weight get tested. SharedRoot is notable less for any single kernel bug than for showing the boundary is reachable at all.

The takeaway is to treat an AI agent's execution environment as a boundary to verify, not assume. Knowing which mode your users run, and what a local session can touch, pays off no matter how this flaw resolves.

Signal 02 — Read It as a Capability, Not an Incident

Our assessment is that the right posture is calibrated attention rather than alarm. This is a responsible disclosure with a documented technique, not an attack in progress, and the mitigation — defaulting local work to the cloud — is already the shipping behavior for most users. Treating it as an emergency would misread it; dismissing it because nothing has happened would waste a clear early signal.

The useful middle is to log the finding, confirm your own configuration, and track whether Anthropic hardens the local mode further.

Signal 03 — Trust Boundaries Are the Real Story

The detail we find most durable is architectural: the researchers' own framing is that patching one kernel bug re-arms on the next, because the deeper exposure is how much of the host a guest VM can reach. Our view is that this is where the lasting work sits — narrowing what a local agent session can see, rather than racing each flaw.

We would treat SharedRoot less as a discrete bug to close than as a prompt to ask a sharper question about agentic tools generally: when the sandbox fails, how much is on the other side of it?

Sources