A flaw in Anthropic's Claude Cowork lets its AI agent break out of its virtual machine and reach sensitive files across a user's Mac, exposing a serious gap in the tool's sandbox protections.
Accomplish AI researchers said on July 23 that a locally running Cowork session could exploit a Linux kernel flaw and gain root access inside its virtual machine. Once the session had root access, the agent could reach the Mac's filesystem through a writable mount.
The researchers called the attack SharedRoot. In their demonstration, they connected one folder to a new Cowork session and gave Claude a single instruction. The agent then read and wrote files outside the approved folder without showing another permission prompt.
Accomplish AI said the accessible files included SSH private keys, cloud credentials, browser data, and other material available to the person logged in to the Mac. The researchers didn't report evidence that anyone had used SharedRoot against Cowork users outside the controlled test.
The mount covered the Mac's full filesystem, but that didn't mean the agent could automatically read or change every file. Access still depended on the logged-in user's permissions and macOS protections, including safeguards around certain system and private data.
Anthropic had already made cloud execution the default for Cowork sessions on July 7 when the company expanded Cowork to the web and mobile devices. Desktop users could still choose local processing, so SharedRoot remained relevant to sessions using that option.
A Linux flaw exposed Cowork's host filesystem mount
Cowork's local execution mode placed the agent inside a Linux virtual machine, where it ran as an unprivileged user. A separate service called coworkd ran with root privileges and managed files shared with the session.
Accomplish AI found that the virtual machine also contained a read-write VirtioFS mount of the Mac's filesystem. An ordinary Cowork session couldn't access the mount, but gaining root privileges inside the virtual machine opened it to the agent.
The entire host filesystem, mounted into the VM and writable. Only the VM's root user can see it, and reaching it is the last move in the escape. Image credit: Accomplish AISharedRoot used CVE-2026-46331, a flaw in the Linux kernel's traffic-control packet-editing code. Incorrect copy-on-write handling could corrupt page-cache memory and allow a local user to alter protected files.
The researchers used that corruption to replace a file that the root-level coworkd service later executed. Because coworkd already ran as root, the altered file gave the Cowork session root access inside the guest operating system.
SharedRoot didn't break Apple's virtualization system. Root access instead let the agent use a filesystem mount that Cowork had placed inside the virtual machine for trusted processes.
The Linux flaw was only one part of the attack. Accomplish AI said another way to gain guest-root access could expose the Mac again as long as Cowork continued mounting the full host filesystem read-write inside the virtual machine.
Cloud execution avoids the local escape path
Anthropic's July 7 update made remote execution the default for Cowork, allowing sessions to continue on the company's servers while a user's computer is offline. Desktop features that need local files or applications can still use the person's Mac.
Four independent locks. The numbered path is the escape, turning red once it goes wrong. Each green lock closes it at a different point; any one is enough, and each takes a whole category with it, not just this CVE. Image credit: Accomplish AICloud execution avoids SharedRoot because Claude no longer runs inside the local virtual machine that exposed the Mac's filesystem. It doesn't remove the risks that come with granting an agent access to sensitive files, accounts, or services.
Accomplish AI said it reported SharedRoot to Anthropic and that Anthropic closed the submission as "Informative." Anthropic hasn't publicly explained that decision.
The researchers recommended mounting only folders users approve and making those mounts read-only when possible. Accomplish AI also called for stronger protections around the privileged service and Linux features that could help an attacker gain root access.
How to protect yourself from SharedRoot
Use Cowork's default cloud execution instead of local processing when possible. Give Claude access only to the folders needed for a task, and avoid connecting directories that contain SSH keys, cloud credentials, browser data, or other sensitive files.
Anyone who ran local Cowork sessions with untrusted files should consider rotating credentials the agent could have reached. Users should also be cautious about giving AI agents access to commands or files that could affect the wider system.
