Critical Flaw in Claude Cowork Enables AI Agent to Escape VM and Access macOS Files

Key Takeaways

• A sandbox‑escape flaw, codenamed SharedRoot, was discovered in Anthropic’s Claude Cowork macOS desktop app that lets a locally‑run AI agent break out of its Linux virtual machine (VM) and access any file on the host Mac as the logged‑in user.
• The vulnerability stems from the VM’s root filesystem (/) mounted at `/mnt/.
• The bug arises because the entire host filesystem (/) is mounted read‑write inside the VM, giving the agent a direct path to the host once it gains root inside the VM.
• Exploitation leverages an unprivileged user namespace, the Linux act_pedit traffic‑control subsystem, and a recently disclosed kernel flaw (CVE‑2026‑46331, “pedit COW”) to obtain guest‑root, then traverse the shared mount to the host filesystem.
• Approximately 500,000 macOS users who ran Cowork locally were exposed before the issue was patched; the latest Cowork version defaults to cloud execution, which mitigates the risk, but local‑run users remain vulnerable unless they apply mitigations.
• Mitigation steps include disabling unprivileged user namespaces, tightening the seccomp filter, preventing autoload of kernel modules, and restricting the VM’s filesystem share to only the explicitly‑connected folders (or mounting it read‑only) while running the coworkd daemon with ProtectSystem=strict in its own mount namespace.
• The discovery highlights a broader, ongoing challenge: Linux privilege‑escalation bugs in the net/sched subsystem appear regularly, meaning defenders are often “one bug behind” and must adopt defense‑in‑depth strategies rather than relying on patch‑only fixes.

Overview of the SharedRoot Vulnerability

Cybersecurity researchers from Accomplish AI identified a critical sandbox‑escape vulnerability in Anthropic’s Claude Cowork macOS desktop application. The flaw, dubbed SharedRoot, allows an AI agent running inside a Linux virtual machine (VM) to break out of its confined environment and read or write any file on the host macOS system under the privileges of the logged‑in desktop user. The issue affected an estimated 500,000 macOS users who had opted to run Cowork locally before a patch was released.

How Claude Cowork Runs on macOS

Claude Cowork’s macOS desktop app executes under the user account that is currently logged into the system. While the user interface runs natively, the actual AI agent workload is off‑loaded to a lightweight Linux VM created via Apple’s Virtualization framework. Each session receives its own disposable, unprivileged user account inside the VM, and a Secure Computing Mode (seccomp) filter is applied to restrict syscalls and harden the sandbox. User‑specified folders are shared into the VM by a privileged daemon called coworkd, which operates as root on the host.

The Core Problem: Full Host Filesystem Shared Read‑Write

The critical misconfiguration lies in how coworkd shares the host filesystem with the VM. Instead of limiting the share to only the folders the user explicitly connected, the daemon mounts the entire host root directory (/) read‑write inside the guest at the path /mnt/.virtiofs-root. Because the mount is readable and writable by the VM’s root user, any process that attains root inside the VM can instantly access the host’s complete filesystem as if it were a local directory.

Escalation Path: From Unprivileged User to Guest‑Root

To reach guest‑root inside the VM, the attacker chains together several Linux kernel features:

1. User and Network Namespaces – By creating an unprivileged user namespace, the agent gains a set of capabilities, including CAP_NET_ADMIN, within a isolated network namespace.
2. Access to act_pedit – The CAP_NET_ADMIN privilege permits interaction with the Linux traffic‑control (tc) subsystem, specifically the act_pedit packet‑editing module.
3. Exploiting CVE‑2026‑46331 (pedit COW) – A recently disclosed use‑after‑free bug in the act_pedit module allows an unprivileged user to trigger a kernel memory corruption that elevates them to root inside the VM’s user namespace.

Once the agent obtains guest‑root, it can read/write any file under /mnt/.virtiofs-root, which mirrors the host’s entire filesystem. Consequently, sensitive data such as SSH keys, cloud service credentials, personal documents, and application configuration files become accessible without any additional permission prompts.

Impact and Exposure

With this level of access, the malicious agent could exfiltrate or alter data, install persistence mechanisms, or leverage the host to launch further attacks. Accomplish AI emphasized that the vulnerability was not theoretical: they demonstrated the escape by connecting a folder to a fresh Cowork session, sending a single message, and observing the agent read and write files across the Mac outside the shared folder, all without any user consent prompts.

Approximately half a million macOS users who had chosen to run Claude Cowork locally were potentially affected before the flaw was disclosed. Anthropic responded by classifying the report as informative and did not issue a direct patch for the existing local‑run version. Instead, the company shifted the default execution model for Cowork to cloud‑based processing, which sidesteps the problematic local VM altogether. Users who continue to run the agent locally, however, remain exposed unless they apply mitigations.

Technical Details of the Exploit Chain

The exploit relies on the interaction of several Linux kernel mechanisms:

• Unprivileged User Namespaces permit the creation of isolated environments where certain capabilities (like CAP_NET_ADMIN) are available even to non‑root processes.
• Network Namespaces give the process its own network stack, enabling it to manipulate tc filters and access the act_pedit subsystem.
• Seccomp Filter in the default Cowork configuration was found to be overly permissive, allowing the necessary syscalls for namespace creation and tc operations.
• Module Autoloading allowed the kernel to load the act_pedit module on demand, providing the attack surface for the pedit COW vulnerability.

By combining these elements, an attacker can traverse from an unprivileged user inside the VM to full guest‑root, then leverage the shared read‑write mount to reach the host filesystem.

Recommendations for Mitigation

To defend against SharedRoot‑style escapes, administrators and developers should adopt a layered approach:

1. Disable Unprivileged User Namespaces – Setting kernel.unprivileged_userns_clone=0 prevents ordinary users from creating the namespaces needed for the initial privilege escalation.
2. Restrict Seccomp Profiles – Tighten the seccomp filter to block syscalls associated with namespace creation (clone, unshare, setns) and tc/netlink operations unless absolutely required.
3. Prevent Autoloading of Kernel Modules – Configure the kernel to disallow on‑demand loading of modules like act_pedit (e.g., via modules_disabled=1 or by blacklisting specific modules).
4. Limit the VM’s Filesystem Share – Instead of mounting the entire host root, share only the directories the user explicitly selected. If a full host share is unavoidable, mount it read‑only inside the VM.
5. Hardening the coworkd Daemon – Run coworkd with ProtectSystem=strict in its own mount namespace, ensuring that any binaries it executes cannot be replaced or tampered with by the session user.
6. Monitor and Audit – Log attempts to create user/network namespaces, load tc modules, or access paths outside the intended shared folders, and alert on anomalous activity.

Broader Implications: A Persistent Privilege‑Escalation Cycle

The researchers warned that SharedRoot is emblematic of a larger, systemic issue: the Linux net/sched subsystem (which includes traffic‑control components like act_pedit) regularly yields privilege‑escalation bugs. As one flaw is patched, another emerges, often with a working exploit appearing within hours. This creates a scenario where defenders are perpetually “one bug behind.” Consequently, relying solely on timely patching is insufficient; organizations must implement robust isolation controls, least‑privilege principles, and defense‑in‑depth strategies to mitigate the risk of similar escapes in the future.

Conclusion

The SharedRoot vulnerability in Claude Cowork demonstrates how a seemingly benign configuration—sharing the entire host filesystem read‑write into a sandboxed VM—can be turned into a powerful escape route when combined with existing Linux kernel weaknesses. By understanding the precise steps attackers take (namespace creation, tc/act_pedit access, exploitation of pedit COW) and applying the mitigations outlined above, users and administrators can significantly reduce the likelihood of a local AI agent breaking out of its confinement and compromising the host macOS system. Continued vigilance, coupled with proactive hardening of virtualization and containerization environments, remains essential as AI‑driven applications become more pervasive on end‑user devices.