AI agents are supposed to stay in their sandbox like a toddler at a birthday party — contained, supervised, nowhere near the good silverware. Turns out Claude Cowork's sandbox had an exit propped open the whole time, and it only took one message to find it.

A Filesystem Mount Nobody Meant to Share

Security researcher Oren Yomtov at Accomplish AI found that Claude Cowork — Anthropic's tool for running AI agents locally on macOS — mounted the entire host filesystem read-write into its Linux VM at a path called /mnt/.virtiofs-root. That mount was supposed to be locked down to root inside the guest only, not reachable by the session user.

Yomtov's team, who named the attack chain SharedRoot, showed that a session user could abuse a Linux kernel networking subsystem, chained with CVE-2026-46331, to grab guest-root privileges and then walk straight through that mount onto the real Mac. In their demo, connecting one folder and sending a single message was enough to get the agent reading and writing files anywhere on the host — SSH keys, cloud credentials, all of it — with zero permission prompt.

About 500,000 Reasons to Care

Roughly 500,000 macOS users running local Cowork sessions were exposed before this became public. That's not a niche misconfiguration — that's half a million people's SSH keys sitting one prompt away from a stranger, and it undercuts the entire pitch of a sandboxed AI agent: the sandbox is the product.

Anthropic's fix is more of a shrug than a patch — they closed the report as informational and instead shifted Cowork's default execution to the cloud, sidestepping the local VM problem rather than solving it outright. Anyone still running Cowork locally is, as far as this report goes, still standing in the blast radius.

"AI agent escapes its sandbox" is going to be a recurring headline in this industry for a while yet — the pitch is autonomy, the risk is autonomy, and right now the fix is mostly please use our cloud instead.

If this kind of thing keeps you up at night, grab our free Developer's Security Checklist — or just talk to us directly.

Source: The Hacker News