Accomplish AI finds SharedRoot escape in Claude Cowork on Mac

A sandbox that isn't really a sandbox is the interesting bit of this one. Researchers at Accomplish AI say they connected a folder to a fresh Claude Cowork session, sent a single message, and watched the agent walk out of its Linux VM and start reading and writing files across the host Mac, according to The Hacker News. They named the chain SharedRoot and say roughly 500,000 macOS users running local Cowork sessions were exposed before the mitigation shipped.

The mechanics are less exotic than the name suggests. Claude Cowork runs the agent inside a Linux virtual machine created via Apple's Virtualization framework, and a root daemon called coworkd mounts folders you attach into that VM. The problem, as the researchers describe it, is that the entire host filesystem gets shared into that VM read-write, at a path only guest-root can reach. Their exploit loads the kernel's act_pedit traffic-control subsystem into an unprivileged user namespace, uses CVE-2026-46331 to obtain guest-root, then walks out through the mount and reaches whatever the logged-in Mac user can reach. That includes SSH keys and cloud credentials sitting under the home directory.

The response is where this becomes a story about AI agents rather than just a kernel bug. Anthropic reportedly closed the report as 'informative' without shipping a fix, on the reasoning that the latest Cowork version defaults to cloud execution, where this specific escape path does not apply. It's a defensible position if you assume users will move to the default, but it also codifies a particular threat model: the local sandbox is treated as a convenience, not a security boundary, and a prompt-injected agent on a developer's laptop is left as the user's problem.

The honest caveat is that this is a single disclosure from one research shop, and the reporting doesn't tell you how many of those 500,000 users are still on local execution, or what Anthropic's own telemetry says about that mix. If you run coding agents locally against real credentials, though, the practical read is the one the researchers themselves suggest: mount connected folders read-only where you can, and treat 'the agent runs in a VM' as a lot weaker a guarantee than it sounds.