--- title: "Two Cowork Security Reports, Two Acknowledgements, No Fix" pubDatetime: 2026-07-29T11:24:00.000Z description: "SharedRoot walks out of Claude Cowork's Mac sandbox using a public Linux kernel bug and a writable host mount. Anthropic closed it as Informative, which is the second Cowork report in seven months to be acknowledged and left alone." tags: [ai-security, sandboxing, anthropic, claude-cowork, vulnerability-disclosure, 2026, 2026-q3, 2026-07] --- > [!tldr] TL;DR > Accomplish AI's [SharedRoot write-up](https://accomplish.ai/blog/sharedroot-escaping-claude-cowork-sandbox/), published six days ago, shows Claude Cowork on a Mac breaking out of its Linux VM from one short chat message and no permission prompt, reaching SSH keys and cloud credentials on the host. The chain uses an unprivileged user namespace to reach the kernel, escalates with the public pedit COW bug (CVE-2026-46331), then walks out through a virtiofs mount that shares the host filesystem into the guest read-write. Anthropic closed the report as Informative, since the CVE fell inside its 30-day bounty window for new bugs, and the researchers call that a fair scope decision. Cowork's switch to cloud execution by default on 7 July closes the path for anyone who leaves the default alone. Local execution is still offered, still exposed, and this is the second Cowork report in seven months that Anthropic acknowledged without shipping a fix. The privilege escalation at the centre of SharedRoot has nothing to do with Anthropic. CVE-2026-46331, the pedit copy-on-write bug, is an upstream Linux flaw that Massimiliano Oldani [published a proof-of-concept for](https://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html) 42 days ago. It hands root to any unprivileged local user on kernels between v5.18 and v7.1-rc6. Cowork ships a Linux VM, the VM ran a vulnerable kernel, and an agent that executes code on your behalf is an unprivileged local user with a chat interface. What Anthropic contributed is the last step. Once the exploit holds root inside the guest, the host's filesystem is already there, mounted read-write over virtiofs. Escaping the VM stops being a research problem and becomes a `cd`. ## The Kernel Bug Is Upstream, the Mount Is a Product Decision Splitting those two halves changes what the story is about. Kernel bugs get patched. Every sandbox vendor eats a stream of them, and the honest question is what a single guest-root primitive buys an attacker when it lands. Here it buys everything. SSH keys, cloud credentials, whatever else lives in a home directory, read and write, from one message the user never approved. A boundary that converts one kernel bug into total host compromise is doing less work than the word "sandbox" implies, and that property is Anthropic's to change. The reason for the mount is obvious enough. A local file agent earns its keep by touching local files, so the wall has holes cut in it by design. That makes the writable scope of those holes the security-relevant choice, well ahead of whether the VM itself is escapable. ## "Informative" Answers a Bounty Question, Not a Risk Question Anthropic closed the report as Informative and shipped no direct fix. Per Accomplish AI's own account, the reasoning was that the underlying CVE sat inside the program's 30-day window for newly published bugs, and that the researchers' other suggestions counted as defense-in-depth hardening rather than separate vulnerabilities. The people who found the bug agree with the triage and disagree with the conclusion: > [!quote] > "That's a reasonable call for a bounty program. But a program's scope and your exposure on your own laptop are different questions." That is the whole disagreement, stated more precisely than most of the coverage manages. Bounty scope decides who gets paid. It says nothing about whether a consumer Mac product should let one kernel CVE reach your credentials. Headlines reading this as Anthropic waving off a critical flaw are picking a fight the researchers declined to pick. Anthropic has said nothing else publicly. TheNextWeb and other outlets got no spokesperson comment, and no Anthropic-authored advisory on SharedRoot exists that I can find. ## The Mitigation Landed Before the Disclosure Cowork moved to cloud execution by default on 7 July, 22 days ago, when Anthropic [took it to web and mobile](https://www.fingerlakes1.com/2026/07/09/claude-cowork-ai-agent-launches-as-anthropic-expands-ai-assistant-to-cloud-and-mobile/). The reason was cross-device continuity. The effect is that sessions stopped running on the user's machine, which retires the local attack surface for anyone who accepts the default. So the sequence runs: product change, then kernel PoC in the wild, then disclosure. Coverage that presents cloud-by-default as Anthropic's answer to SharedRoot has the causation backwards, and coverage that skips the change entirely leaves readers thinking every Cowork user was one message from losing their SSH keys. 9to5Mac's [write-up](https://9to5mac.com/2026/07/27/claude-cowork-escaped-sandbox-on-mac-gain-full-access-to-all-files/) puts the number of affected Mac users at around 500,000. The group that matters now is smaller: whoever opts back into local execution today. No source I have found puts a number on that. > [!warning] > If you run Cowork locally on a Mac, the researchers report the escape still works. Switching the session to cloud execution is the mitigation that exists. Their hardening advice for staying local (disable unprivileged user namespaces, restrict filesystem sharing, run the daemon with strict mount protections) comes from the write-up, and Anthropic has not endorsed it. ## Second Report, Same Ending January's Cowork story was a different bug in a different place. PromptArmor [showed prompt injection](https://www.promptarmor.com/resources/claude-cowork-exfiltrates-files) driving file exfiltration through one of Anthropic's own allowlisted API domains, 196 days ago. No sandbox escape, no kernel involved. Anthropic acknowledged it and did not remediate it. Two independent reports of a local agent leaking the host it runs on, seven months apart, both closed without a fix. Each closure has a defensible rationale attached, and the rationales are unrelated to each other. The pattern they add up to is a product whose isolation story keeps failing at the seam where the agent meets the user's files, and a vendor that keeps treating those failures as out of scope rather than as the same recurring design question. The cloud default helps, and it arrived for reasons that had nothing to do with security. That is a fine outcome and a poor process. The next local agent that ships a writable host mount will get the same free pass until someone treats the mount, rather than the kernel, as the bug. --- **Sources** - Oren Yomtov, Accomplish AI, [SharedRoot: Escaping the Claude Cowork Sandbox](https://accomplish.ai/blog/sharedroot-escaping-claude-cowork-sandbox/) (23 July 2026) - The Hacker News, [Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files](https://thehackernews.com/2026/07/claude-cowork-flaw-could-let-ai-agent.html) (23 July 2026) - The Hacker News, [pedit COW (CVE-2026-46331): How a Linux Kernel Bug Hands Out Root Privileges](https://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html) (17 June 2026) - PromptArmor, [Claude Cowork exfiltrates files](https://www.promptarmor.com/resources/claude-cowork-exfiltrates-files) (14 January 2026) **Coverage** - 9to5Mac, [Claude Cowork escaped sandbox on Mac, gain full access to all files](https://9to5mac.com/2026/07/27/claude-cowork-escaped-sandbox-on-mac-gain-full-access-to-all-files/) (27 July 2026) - AppleInsider, [Claude Cowork can escape its sandbox, rummage through all of your files](https://appleinsider.com/articles/26/07/27/claude-cowork-can-escape-its-sandbox-rummage-through-all-of-your-files) (27 July 2026) - TheNextWeb, [Claude Cowork sandbox escape](https://thenextweb.com/news/claude-cowork-sandbox-escape-mac-files-sharedroot) (26 July 2026) - Fingerlakes1, [Claude Cowork AI Agent Launches as Anthropic Expands to Cloud and Mobile](https://www.fingerlakes1.com/2026/07/09/claude-cowork-ai-agent-launches-as-anthropic-expands-ai-assistant-to-cloud-and-mobile/) (9 July 2026) **Related posts** - [Cowork's Sandbox Escape and the Fix That Came First](/posts/cowork-sharedroot-sandbox-escape) - [Sandboxes are just escape rooms for LLMs](/posts/sandboxes-escape-rooms-llms) - [Three Indirection Steps From a Reverse Shell](/posts/ai-agent-security-lethal-trifecta)