--- title: "Cowork's Sandbox Escape and the Fix That Came First" pubDatetime: 2026-07-28T09:22:00.000Z description: "Accomplish AI chained a kernel bug to a writable host mount and walked out of Claude Cowork's VM with read-write access to the whole Mac. Anthropic closed the report as Informative, and the cloud default everyone is calling the fix shipped two weeks before the disclosure." tags: [ai-security, sandboxing, anthropic, claude-cowork, vulnerability-disclosure, 2026, 2026-q3, 2026-07] --- > [!tldr] TL;DR > Accomplish AI [published](https://accomplish.ai/blog/sharedroot-escaping-claude-cowork-sandbox/) "SharedRoot" on 23 July: a single chat message makes Claude Cowork break out of its Linux VM on a Mac and read and write the entire host filesystem, credentials included. The chain is a kernel privilege-escalation bug (CVE-2026-46331, the `act_pedit` copy-on-write flaw) plus a VirtioFS mount that exposes the host `/` inside the guest read-write at `/mnt/.virtiofs-root`. Anthropic's bounty program closed the report as Informative and issued no fix for local mode, which is still offered and, per the researchers, still exploitable. The cloud-execution default that coverage treats as the response shipped on 7 July as a mobile and web product feature, more than two weeks earlier. Only users who chose local execution were ever exposed. The sandbox had a door in it the whole time. Once Accomplish AI's exploit reaches root inside Cowork's guest VM, there is nothing left to escape: the host's `/` is already mounted inside the guest, writable, at `/mnt/.virtiofs-root`. In the researchers' words, guest-root "can see /mnt/.virtiofs-root, the whole host /, shared in read-write." The kernel bug does the hard work; the mount does the rest. That shape matters more than the CVE. The privilege escalation is a Linux problem with a patch cycle and a number, disclosed publicly in June 2026 (Accomplish AI references it; the exact date isn't confirmed in any advisory I could find). The writable host mount is a design decision. A local file agent needs to touch your files, so the VM boundary was always going to be thin, and thin boundaries fail all the way through when a single guest-root primitive lands. ## What Anthropic Actually Did, and When Coverage of the disclosure keeps arriving at a comfortable ending: Cowork now defaults to cloud execution, so the problem is handled. Check the dates. Anthropic [announced](https://claude.com/blog/cowork-web-mobile) the cloud default on 7 July, three weeks ago, as part of taking Cowork to web and mobile for Max subscribers. The Verge's [write-up](https://www.theverge.com/ai-artificial-intelligence/961978/anthropic-claude-cowork-mobile-web) of that launch describes cross-device continuity as the reason. Accomplish AI published five days ago, on 23 July. A change that ships 16 days before a disclosure is not a response to it. Local execution stays available. The researchers say it stays exploitable. So the thing being credited as the fix moved the default for new sessions and left the vulnerable path exactly where it was, one settings toggle away. ## "Informative" Is a Bounty Verdict, Not a Risk Assessment Anthropic closed the HackerOne report as Informative, per [The Hacker News](https://thehackernews.com/2026/07/claude-cowork-flaw-could-let-ai-agent.html), which broke the story on the day of publication with quotes from Accomplish AI's Oren Yomtov and CTO Or Hiltch. No public report link exists, so this detail rests on the researchers' account. Here is the part outrage-shaped coverage skips: Accomplish AI agrees the call was defensible. Anthropic judged the underlying CVE to fall inside a 30-day bounty-eligibility window and treated the rest of the submission as defense-in-depth hardening rather than standalone vulnerabilities. The researchers call that "a reasonable call for a bounty program" and argue anyway that it understates how exposed users are. Both things hold. Bounty triage answers "do we owe this person money and a CVE credit," which is a narrow question with rules attached. Whether shipping a consumer Mac agent with the host root writable inside its sandbox is a good idea is a different question, and Informative doesn't answer it. AppleInsider [notes](https://appleinsider.com/articles/26/07/27/claude-cowork-can-escape-its-sandbox-rummage-through-all-of-your-files) Anthropic hasn't publicly explained the decision, and I found no Anthropic-authored statement or advisory on SharedRoot at all. ## Scoping the Blast Radius The number in circulation is 500,000 macOS users. Techzine [traces it](https://www.techzine.eu/news/security/143187/claude-cowork-escapes-from-virtual-machine/) to Accomplish AI's own estimate of the local-mode population, not to anything Anthropic published. Treat it as an order of magnitude. Three qualifiers belong next to it: - Exposure required opting into local processing. Cloud-mode sessions were never affected. - Nothing in the public record shows real-world exploitation. This is a researcher demonstration. - The exploit needs a hostile instruction to reach the agent, which for a tool that reads and writes your files is a low bar, but it is a bar. None of that makes the mount design fine. It does mean the story is "an opt-in mode is broken and unpatched," rather than "every Cowork user was owned." > [!warning] > If you run Cowork in local execution mode on a Mac, the researchers report the escape still works. Switching that session to cloud execution is the only mitigation available today. ## Nobody Is Discussing This The disclosure got trade-press pickup across five days: The Hacker News on the 23rd, [9to5Mac](https://9to5mac.com/2026/07/27/claude-cowork-escaped-sandbox-on-mac-gain-full-access-to-all-files/) and AppleInsider yesterday. Hacker News users submitted the Accomplish AI post three separate times, on [23 July](https://news.ycombinator.com/item?id=49020807), [24 July](https://news.ycombinator.com/item?id=49031814) and [25 July](https://news.ycombinator.com/item?id=49044382). Combined score: nine points. Combined comments: zero. A full host-filesystem escape from a mainstream AI agent's sandbox generated no discussion on the forum where agent security gets argued about daily. The disclosure landed everywhere and stuck nowhere, which is its own small data point about how much attention this class of bug currently commands. The lesson generalises past Cowork. Every local agent product ships a sandbox whose walls are pierced by design, because the product's value is on the other side of the wall. Ask which mounts are writable before asking whether the VM is escapable, since the second question only matters as much as the first answer allows. --- **Sources** - Accomplish AI, [SharedRoot: Escaping the Claude Cowork Sandbox](https://accomplish.ai/blog/sharedroot-escaping-claude-cowork-sandbox/) (23 July 2026) - Ravie Lakshmanan, The Hacker News, [Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files](https://thehackernews.com/2026/07/claude-cowork-flaw-could-let-ai-agent.html) (23 July 2026) - Anthropic, [Claude Cowork on web and mobile](https://claude.com/blog/cowork-web-mobile) (7 July 2026) - The Verge, [Anthropic is launching Claude Cowork on mobile and web](https://www.theverge.com/ai-artificial-intelligence/961978/anthropic-claude-cowork-mobile-web) (7 July 2026) **Coverage / discussion** - 9to5Mac, [Claude Cowork escaped sandbox on Mac](https://9to5mac.com/2026/07/27/claude-cowork-escaped-sandbox-on-mac-gain-full-access-to-all-files/) (27 July 2026) - AppleInsider, [Claude Cowork can escape its sandbox, rummage through all of your files](https://appleinsider.com/articles/26/07/27/claude-cowork-can-escape-its-sandbox-rummage-through-all-of-your-files) (27 July 2026) - Techzine, [Claude Cowork escapes from virtual machine](https://www.techzine.eu/news/security/143187/claude-cowork-escapes-from-virtual-machine/) **Related posts** - [Sandboxes are just escape rooms for LLMs](/posts/sandboxes-escape-rooms-llms) - [OpenCode Denies `git`. It Runs `$(which git)` Just Fine.](/posts/stop-using-opencode-security-teardown) - [Three Indirection Steps From a Reverse Shell](/posts/ai-agent-security-lethal-trifecta)