SharedRoot Flaw Let Claude Cowork Escape Mac Sandbox
SkimNews Take
Sandboxing is the primary containment model for agentic AI tools, so a single escape flaw in a widely deployed product exposes how capability is scaling ahead of the mechanisms meant to keep it bounded.
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Accomplish AI discovered the ShareRoot sandbox escape in Claude Cowork after connecting a folder to a session and watching the agent break out of the VM to read and write files across the host Mac with no permission prompt.
- The flaw stemmed from the entire host filesystem being mounted read-write into the agent's Linux VM at /mnt/.virtiofs-root, giving any guest-root path access to the underlying host.
- The exploit chain uses unprivileged user namespaces to load the Linux kernel's act_pedit Traffic Control subsystem and trigger CVE-2026-46331 (pedit COW) for guest-root, then accesses the host's / with elevated privileges.
- Anthropic closed the responsible disclosure report as informative without issuing a fix, but the latest Cowork version defaults to cloud execution—users who opt to run the agent locally remain exposed.
- Researcher Oren Yomtov argued the issue is structural: the Linux net/sched subsystem regularly yields the same shape of privilege escalation, leaving any system "one bug behind" regardless of how fast patches ship.
- Accomplish's recommended mitigations include disabling unprivileged user namespaces, tightening seccomp filters, stopping autoloading of modules, and scoping the virtiofs mount to connected folders rather than all of /.
Why it matters: With local execution, the Claude Cowork agent could access SSH keys, cloud credentials, and any data on roughly 500,000 Macs before the issue was addressed. Anthropic's decision to close the report without a fix and the researcher's warning that patch cadence cannot outpace Linux kernel privilege-escalation bugs means users running AI agents locally face a recurring exposure that cloud-only execution sidesteps.
