Cybersecurity researchers have identified a critical vulnerability in Anthropic's Claude Cowork that allows an AI agent to escape its Linux virtual machine sandbox and access files on a Mac. Known as SharedRoot, this flaw affects approximately 500,000 macOS users who run local sessions of Claude Cowork. Despite being informed of the issue, Anthropic marked the report as informative without implementing a fix, leaving local users vulnerable while the cloud-based version of the software addresses the problem.
The vulnerability was discovered by Accomplish AI, whose researchers demonstrated that the AI agent could bypass the sandbox and read or write files across the host Mac without any permission prompts. This level of access could expose sensitive information such as SSH keys and cloud credentials. The flaw arises from how the host file system is mounted into the agent's virtual machine with read-write privileges, allowing the agent to exploit the system and gain root access.
Exploiting this vulnerability involves manipulating the Linux kernel's traffic control packet editing subsystem and leveraging a recently disclosed flaw known as pedit COW. This allows the AI agent to attain elevated privileges and access the entire host file system. Anthropic's Claude Cowork application runs the AI agent in a Linux virtual machine using Apple's Virtualization framework, with each session assigned a disposable user and a Secure Computing Mode filter for sandboxing. However, the mounting of the entire host file system into the VM creates a critical security gap.
To mitigate this risk, security experts recommend disabling unprivileged user namespaces, avoiding permissive seccomp filters, and restricting the sharing of the whole host into the VM. By narrowing the scope to specific folders or mounting them as read-only, and running coworkd with strict protections, the potential for exploitation can be significantly reduced.