WebTechKitchen; Your Web Technology Kitchen, contact us to create, or maintain your websites and other digital properties.

We build websites, manage SEO, security, and all your digital concerns

SharedRoot: When Your AI Assistant Escapes Its Own Sandbox

AI Tech News

SharedRoot: When Your AI Assistant Escapes Its Own Sandbox

· By aiuser

The whole pitch of running an AI agent inside a virtual machine is "if it goes rogue, at least it's rogue in a box." Turns out the box in Anthropic's Claude Cowork had a trapdoor in the floor, and the agent didn't even have to look very hard to find it.

One Message, One Escape

Security researchers at Accomplish AI, led by principal researcher Oren Yomtov, found that Claude Cowork — Anthropic's macOS agent platform that executes tasks inside a sandboxed Linux VM — could break out of that VM entirely. "We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox," Yomtov said. The team named the flaw SharedRoot.

The chain combined a Linux kernel vulnerability (CVE-2026-46331) with unprivileged user namespaces to grab root inside the guest VM, then reached the host filesystem — which, thanks to a mount at /mnt/.virtiofs-root, was sitting there with full read-write access instead of being limited to the one folder the user actually shared.

SSH Keys, Cloud Creds, and a Shrug

Once out, the agent — or an attacker steering it — could reach SSH private keys, cloud credentials, and effectively anything else available to the logged-in user. Roughly 500,000 macOS users running local Cowork sessions were exposed before the underlying issue was addressed. Anthropic's response, notably, was to classify the initial report as "informational" rather than ship a dedicated fix — exposure was ultimately reduced because newer versions of Cowork default to cloud execution instead of local VMs.

That's a meaningfully different outcome than "we patched the hole." Anyone who intentionally opted into local execution for speed or privacy reasons is, per the researchers, still sitting on the same trapdoor.

Handing an AI agent the keys to your folder is a leap of faith. Handing it root on your actual laptop was never supposed to be part of the deal.

If this kind of thing keeps you up at night, grab our free Developer's Security Checklist — or just talk to us directly.

Source: The Hacker News