Researchers found a one-message escape route out of Claude Cowork's sandbox

Claude Cowork is Anthropic's agentic assistant for coding and day-to-day computer work — connect it to a folder, hand it a task, and it runs semi-autonomously inside a sandbox on the user's own machine. That sandbox is a Linux virtual machine, and its entire premise is containment: whatever the agent does should stay inside the folder it was given, not spill onto the rest of the Mac it's running on. On July 23, security researchers at Accomplish AI published a working exploit chain, nicknamed SharedRoot, that broke that premise. A single message was enough to escape the VM and reach the entire host filesystem — SSH keys, cloud credentials, anything the logged-in user could touch.

We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox.

The researchers kept returning to one design choice as the reason the escape mattered at all: Cowork's VM doesn't just see the folder a user connects. It mounts the entire host filesystem into the guest, read-write, at a path they identified as /mnt/.virtiofs-root. Escaping the VM's own internal restrictions was, in effect, all that stood between the agent and the whole machine — no permission prompt, no second gate.

How the escape actually worked

The chain runs in six steps, and none of them require anything an ordinary Cowork session couldn't already do on its own. The agent creates its own Linux user namespace — an isolation feature that, because Cowork's sandbox permits it, hands the agent root privileges and networking capabilities, but only inside that namespace. It uses those capabilities to configure a traffic-control rule over netlink, which quietly triggers the kernel to auto-load a rarely used module called act_pedit. That module carries a known bug, catalogued as CVE-2026-46331 and public since June, that lets what should be read-only memory get corrupted instead. The bug is enough to poison a root-owned helper binary sitting in the page cache; the next time Cowork's own root daemon re-executes that binary, the poisoned version runs with real root privileges on the host side of the VM boundary. From there, the mounted host filesystem is just another directory to read and write.

Accomplish AI's writeup traces the failure to four separate design decisions, each defensible on its own, that combined into an escape route: unprivileged user namespaces were allowed at all; the sandbox's default-allow filtering let a session call unshare, clone3, and open raw AF_NETLINK sockets; the kernel was left to auto-load unused modules like act_pedit on demand instead of blocking them; and, most consequentially, the entire host filesystem was shared read-write rather than scoped to the folder a user actually connected.

What was actually exposed, and Anthropic's response

Accomplish AI estimated the exposure at roughly 500,000 macOS users running local Cowork sessions before a fix reached them — a scope the firm reported, not one Anthropic has independently confirmed. Anthropic, for its part, classified the disclosure as "informative" rather than a standalone critical bug: the underlying kernel CVE had already been public for about a month, inside the company's usual 30-day disclosure window, and it framed the recommended hardening steps as defense-in-depth rather than a required emergency patch. The company has since moved Cowork to cloud-hosted execution by default, which routes around this specific local escape path entirely. It's sessions still run locally, on builds that predate that shift, where the exposure persists.

The pattern underneath one bug

The specific chain belongs to Cowork, but the underlying design tension does not. Every agentic coding tool now being sold to consumers and developers has to answer the same question: how much of the real machine does an autonomous agent actually need to see to get its job done? Scope the access too narrowly and the agent can't do useful work. Share too much — as Cowork's read-write mount of the entire host did — and a single sandbox bug becomes a full account compromise instead of a contained one. That tradeoff isn't going away as more products race to give agents standing authority over real files, real terminals, and real credentials; it's the same authority question, recurring, as agents move from answering questions to taking actions on machines people actually use for work.

For anyone deciding whether to trust an agent with their machine, SharedRoot is a useful data point rather than a verdict. It doesn't mean agentic coding tools are unsafe to use; it means a sandbox's promise is only as strong as its narrowest gap, and a full read-write host mount is exactly the kind of gap that turns a contained bug into an uncontained one. Anthropic's move to cloud-default execution closes this particular path without requiring anyone to change how they work — which is itself a tell about where the industry is likely headed: agent sandboxes that live off the user's own machine entirely, rather than sandboxes built on top of it.