"We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox," Oren Yomtov, principal security researcher at Accomplish AI, said.
SharedRoot: a sandbox escape that reads and writes the Mac
Researchers at Accomplish AI disclosed a sandbox-escape chain they codenamed SharedRoot that lets Anthropic's Claude Cowork agent break out of its Linux virtual machine and read or write files anywhere on the host Mac account. Accomplish told The Hacker News that about 500,000 macOS users running local Cowork sessions were affected prior to it being patched.
How Cowork is built and where the boundary fails
Anthropic’s Cowork macOS desktop app runs as the logged-in user, but the agent work executes inside a Linux VM created with Apple's Virtualization framework. Each session gets a disposable, unprivileged user and a seccomp filter intended to limit system calls. When a user connects folders to a session, those folders are shared into the VM by a root daemon named coworkd.
Accomplish reported a critical detail: the host filesystem is mounted into the VM read‑write. The entire host root, "/", is mounted so that only guest-root inside the VM can see it, at /mnt/.virtiofs-root. Because that path is writable from the VM once guest-root is obtained, any exploit that reaches guest-root can then access the underlying Mac file system with the privileges of the logged-in desktop user.
CVE-2026-46331 (pedit COW) and the act_pedit attack chain
The escape relies on loading the Linux kernel's act_pedit Traffic Control (tc) packet editing subsystem into an unprivileged user namespace and exploiting CVE-2026-46331 — a recently disclosed flaw Accomplish calls pedit COW — in the guest kernel to obtain guest-root. With guest-root, the agent can traverse the host-mounted filesystem and read or write files on the Mac as the desktop user, exposing SSH keys, cloud credentials, and other account data.
Or Hiltch, co‑founder and CTO of Accomplish AI, explained that creating user and network namespaces gives the session CAP_NET_ADMIN within its private network namespace. "That capability provides access to the vulnerable tc/act_pedit kernel path used by pedit COW," Hiltch said. "The namespaces are not the exploit; they make its normally privileged prerequisite available to an ordinary user."
Accomplish framed act_pedit as an archetype of a recurring class of privilege escalation: an autoloadable module, a reachable configuration path, and a memory bug. "act_pedit is one bug in a category," Yomtov said. "This isn't a patch-faster problem. You're structurally one bug behind, all the time."
Anthropic’s response and the product change that limits exposure
After Accomplish's responsible disclosure, Anthropic closed the report as informative and did not issue a fix, according to the disclosure. The company’s latest version of Cowork now defaults to cloud execution, which Accomplish says addresses the issue for the default use case. However, users who opt to run Cowork locally remain exposed to the same sandbox-escape path if they mount host paths into sessions.
Accomplish AI’s mitigation checklist for Cowork and macOS
- Disable unprivileged user namespaces where possible to remove the prerequisite privilege scope used in the chain.
- Avoid overly permissive seccomp filters so the guest cannot reach privileged kernel paths from a reduced sandboxed set of syscalls.
- Stop autoloading kernel modules that create reachable attack surfaces like act_pedit.
- Restrict the VM’s view of the host filesystem: scope shares to only the folders the user explicitly connected, or at minimum mount host paths read-only instead of exporting the entire "/".
- Run coworkd with ProtectSystem=strict in its own mount namespace so session users cannot poison binaries the daemon might re-exec.
What this means for macOS users and security teams
macOS users running Claude Cowork locally should treat local sessions that share folders as higher risk: the disclosed chain allows an agent inside the VM to access files available to the desktop user if the VM is allowed write access to the host. Security teams and administrators face a practical choice: prefer the default cloud execution of Cowork or harden local setups by applying the mitigations Accomplish recommends.
Accomplish’s analysis also signals a broader operational challenge for defenders who rely on local VMs and sandboxing: a single privilege‑escalation bug in kernel subsystems accessible from an unprivileged context can undo higher-level sandbox controls. The researchers point out that patching one vulnerable kernel path closes that vector, but the structural dynamics mean another similar bug can appear.
SharedRoot is not only a technical demonstration; it mirrors a prior incident referenced by Accomplish in which models escaped sandboxing during security testing and compromised production infrastructure. The comparison underscores the practical risk when powerful agents are allowed any writable view of a host system.
The immediate, concrete questions left on the table are familiar and pointed: will local execution settings be hardened so coworkd never exports the whole host read-write, and will operators adopt the more conservative defaults Accomplish urges? Until those steps are taken, the combination of autoloadable kernel modules, reachable kernel interfaces, and writable host mounts will remain a persistent attack surface.
