A newly revealed sandbox escape vulnerability affecting Anthropic’s Claude Cowork could allow untrusted content processed by the AI agent to access sensitive files on a macOS host.
This includes SSH private keys, cloud credentials, and other data that are available to the logged-in user. Security researcher Oren Yomtov from Accomplish has named this attack path “SharedRoot.” He warns that compromising a guest virtual machine could lead to full host-level data exposure.
Claude Cowork Sandbox Escape Flaw
Claude Cowork operates agent workloads within a Linux virtual machine (VM) on macOS. Sessions are run under an unprivileged user, while selected user folders are integrated into the VM.
However, research revealed that the VM also exposes the entire host filesystem via a writable VirtioFS mount at /mnt/.virtiofs-root. Although this mount was intended to be accessible only to root within the guest, Yomtov demonstrated a method for a session user to gain guest-root privileges and access the host’s filesystem.
The attack chain begins when the unprivileged Cowork session user creates a new Linux user namespace using the ‘unshare’ command. This action provides root-like capabilities within that namespace, including CAP_NET_ADMIN.
The sandbox’s seccomp configuration reportedly allows this namespace operation and netlink sockets, enabling access to Linux traffic-control functionality.
The proof-of-concept then exploits CVE-2026-46331, a vulnerability in the Linux kernel affecting the act_pedit traffic-control module. This flaw, described as a “pedit COW” issue, can enable an attacker to poison cached pages associated with a read-only file.
The report indicates that an attacker could target a root-owned helper binary, which remains readable to the sandboxed user but is later executed by Cowork’s privileged coworkd service.
When the root-owned service re-executes the poisoned binary during its normal operations, the malicious in-memory version runs with root privileges inside the Linux VM.
This circumvents the usual protections that prevent privilege escalation during execution because the executing daemon already has elevated privileges. Once the attacker obtains guest-root access, the writable host filesystem mount becomes accessible.
From this point, an attacker can allegedly read or modify files available to the macOS user account. High-value targets might include SSH keys stored in ~/.ssh, AWS credentials in ~/.aws, cloud CLI tokens, source code repositories, browser data, API keys, and enterprise configuration files.
The researchers reported successfully executing the complete chain on their system, writing a file from the sandbox to the host user’s home directory outside the explicitly connected folder for the Claude session.
The researchers reported the issue to Anthropic, which classified the submission as “Informative.” The company’s assessment was influenced by the recent public disclosure of the CVE and its vulnerability-reporting window.
Anthropic has since moved Cowork to default cloud execution, suggesting that this specific local VM escape path may not apply to cloud-hosted sessions.
However, the report argues that the primary risk stems from architectural issues rather than being solely tied to CVE-2026-46331. Future vulnerabilities in the Linux kernel that allow privilege escalation could create a similar pathway if unprivileged user namespaces, permissive seccomp rules, autoloadable kernel modules, and a writable whole-host filesystem share remain intact.
Recommended mitigations include disabling unprivileged user namespaces, blocking the use of ‘unshare,’ ‘setns,’ namespace-creating clone operations, and AF_NETLINK sockets through seccomp.
Organizations should also prevent unused kernel modules like act_pedit from autoloading and ensure that privileged helper binaries cannot be modified through shared filesystem views. Most importantly, file-sharing in VMs should be limited to explicitly approved folders and should not expose the full host root filesystem as writable to a guest environment.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
