- Cybersecurity researchers from Accomplish AI discovered a sandbox escape vulnerability in Anthropic's Claude Cowork, affecting an estimated 500,000 macOS users running local sessions. The flaw is codenamed SharedRoot.
- Oren Yomtov demonstrated that by connecting a folder to a fresh Claude Cowork session and sending one short message, the agent escaped the sandbox and accessed the host Mac without any permission prompt.
- With this level of access, the agent can access SSH keys, cloud credentials, and other valuable data stored on the Mac via the user's account.
- Anthropic closed the report as informative without issuing a fix. The latest version defaults to cloud execution (mitigating the issue), but local users remain exposed.
- The host filesystem is shared into the VM read-write by a root daemon called coworkd, mounted at /mnt/.virtiofs-root, allowing guest-root to access the entire host.
- The exploit leverages a kernel flaw called pedit COW via the Linux act_pedit Traffic Control subsystem, combined with unprivileged user and network namespaces to obtain guest-root privileges.
- Yomtov noted that the Linux net/sched subsystem regularly produces similar privilege escalation bugs, so patching one leaves the attack chain still viable for the next bug.
- To mitigate, restrict sharing to only connected folders, mount read-only, run coworkd with ProtectSystem=strict, avoid overly permissive seccomp filters, and disable autoloading of modules.
Cybersecurity researchers have identified a significant vulnerability in Anthropic's Claude Cowork, codenamed SharedRoot. This flaw allows AI agents to escape their Linux virtual machine (VM) and access files on the host Mac, affecting around 500,000 users.123
Oren Yomtov, principal security researcher at Accomplish AI, stated, "We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox." The agent was able to read and write files across the Mac without any permission prompts, raising serious security concerns.
The vulnerability stems from the way folders are shared into the VM by a root daemon called coworkd. Yomtov explained, "One detail matters more than the rest: the host filesystem gets shared into that VM read-write." This means that any path to guest-root can grant the agent access to the underlying host, effectively escaping the sandbox.789
The flaw involves exploiting a recently disclosed issue in the Linux kernel's Traffic Control subsystem, allowing the agent to gain elevated privileges and access sensitive data, including SSH keys and cloud credentials. “That capability provides access to the vulnerable tc/act_pedit kernel path used by pedit COW,” said researcher Hiltch.101112
To mitigate this threat, experts recommend restricting the sharing of the entire host into the VM and ensuring that only necessary folders are shared. “Scope it to the folders that were actually connected instead of all of /, or at least mount it read-only,” Yomtov advised.
“The flaw, codenamed SharedRoot, was discovered by cybersecurity researchers at Accomplish AI and affects an estimated 500,000 macOS users running local sessions. Anthropic closed the report as informative without issuing a fix, though the latest version defaults to cloud execution which mitigates the issue for cloud users but leaves local users exposed.”
