A newly disclosed critical sandbox escape vulnerability chain, dubbed SharedRoot, in Anthropic’s Claude Cowork for macOS allows untrusted content processed by the AI agent to break out of its isolated Linux VM and read/write files anywhere on the host Mac, including SSH keys and cloud credentials.
Cowork sandboxes agent sessions inside a Linux VM using Apple’s Virtualization framework, running each session as an unprivileged user with a seccomp filter and a brokered mount layer via a root daemon called coworkd.
Oren Yomtov found that the entire host filesystem is shared into the VM read-write at /mnt/.virtiofs-root, visible only to guest-root and reaching guest-root turns out to be far easier than intended.
Claude Cowork SharedRoot Flaw
The chain begins when the session user calls unshare to enter a new user namespace, becoming root within it and gaining capabilities including CAP_NET_ADMIN, since the guest permits unprivileged user namespaces by default.
With that capability, the attacker configures a traffic-control action using the act_pedit kernel module over a netlink socket, which the permissive seccomp filter allows and which triggers automatic module loading.
The act_pedit module on the guest kernel is vulnerable to CVE-2026-46331 (“pedit COW”), a publicly disclosed Ubuntu kernel bug from June 2026, which allows a page-cache poisoning write primitive against files the attacker can only read.
By poisoning a root-owned helper binary that coworkd later re-executes, the attacker escalates to guest-root without modifying on-disk bytes, evading detection.
Because coworkd already runs as root when it re-executes the poisoned binary, NoNewPrivs protections offer no defense, and guest-root then accesses the writable host mount to compromise the Mac directly.
An estimated 500,000 macOS users running local Cowork sessions were exposed, with attackers able to reach SSH keys, cloud credentials, and any file accessible to the logged-in user’s account.
Anthropic has since shifted Cowork to default cloud execution, meaning the local escape path described no longer applies to most current sessions.
Accomplish AI reported the chain to Anthropic, which closed the report as “Informative” rather than a standalone critical vulnerability, reasoning that the underlying CVE fell within the program’s 30-day disclosure window and that the researchers’ proposed hardening measures amounted to defense-in-depth rather than fixes for discrete flaws.
Oren Yomtov pushed back, arguing that reliance on upstream kernel patches leaves users “structurally one bug behind” given the accelerating pace of kernel privilege-escalation discoveries, some aided by AI-assisted vulnerability research.
Mitigations
Security teams operating agent sandboxes should apply defense-in-depth controls that don’t depend on a clean guest kernel:
- Disable unprivileged user namespaces via
kernel.unprivileged_userns_clone=0or equivalent AppArmor restrictions. - Convert the seccomp filter from a default-allow denylist to a strict allowlist blocking
unshare,setns,clone3, and non-essential socket address families. - Block autoloading of unused kernel modules, including
act_pedit, usinginstall ... /bin/false.
These four architectural changes each independently break the SharedRoot chain and would also neutralize future, unrelated kernel privilege-escalation bugs in the same subsystem class.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
