Overview
Cybersecurity researchers at Accomplish AI have disclosed SharedRoot, a sandbox escape vulnerability in Anthropic’s Claude Cowork that allows the AI agent to break out of its Linux virtual machine and access the macOS host filesystem with full read-write privileges. The flaw, tracked as CVE-2026-46331 (pedit COW), was confirmed to affect approximately 500,000 macOS users running local Cowork sessions prior to a partial mitigation. Anthropic has not issued a dedicated patch, instead defaulting new installations to cloud execution — leaving local-execution users still exposed.
Technical Analysis
Claude Cowork’s macOS desktop app launches a disposable Linux VM via Apple’s Virtualization framework. Each session runs as an unprivileged guest user with a seccomp filter applied. The critical design flaw: the host filesystem (/) is mounted into the VM read-write via VirtioFS at /mnt/.virtiofs-root, visible only to guest-root.
The attack chain to reach guest-root proceeds as follows:
- Namespace creation: An unprivileged session creates user and network namespaces, granting
CAP_NET_ADMINwithin the private network namespace. - Kernel module load: The Linux
act_peditTraffic Control (tc) packet-editing subsystem is loaded into the unprivileged namespace. - CVE-2026-46331 exploitation: The pedit COW vulnerability in the guest kernel is triggered via the tc/act_pedit path, elevating the attacker to guest-root.
- Host filesystem access: With guest-root, the agent accesses
/mnt/.virtiofs-root— the entire macOS host filesystem — and can read or write any file accessible to the logged-in desktop user.
No user interaction beyond connecting a folder to a Cowork session is required. SSH keys, cloud credentials, browser cookies, and any other user-owned data are within reach.
# Simplified conceptual flow (not a working PoC)
ip netns add attacker_ns # create network namespace
ip link add type dummy # trigger CAP_NET_ADMIN path
tc filter add ... action pedit # trigger CVE-2026-46331 in guest kernel
# -> guest-root obtained
ls /mnt/.virtiofs-root/Users/ # host Mac filesystem now readable
Framework Mapping
- AML.T0047 (ML-Enabled Product or Service): The vulnerability exists within an AI agent execution environment, making the ML product the attack surface.
- AML.T0057 (LLM Data Leakage): Guest-root access to the host filesystem enables exfiltration of all user data, including credentials and keys.
- LLM08 (Excessive Agency): The agent is granted far more ambient access than required — the entire host filesystem mounted read-write is a textbook excessive-agency design failure.
- LLM06 (Sensitive Information Disclosure): SSH keys, cloud tokens, and personal files are directly accessible without any permission prompt.
Impact Assessment
- Scope: ~500,000 macOS users running local Cowork sessions at time of disclosure.
- Severity: Critical — zero user interaction required after session initiation; grants equivalent access to a full local user compromise.
- Persistence risk: An agent could plant persistent backdoors, exfiltrate credentials silently, or tamper with local configuration files.
- Vendor response: Anthropic closed the report as informative without a CVE-specific patch. Users opting into local execution remain vulnerable.
Mitigation & Recommendations
- Switch to cloud execution: Navigate to Claude Cowork settings and ensure cloud execution is enabled; avoid local VM mode until a kernel-level fix is confirmed.
- Audit connected folders: Review all folders previously shared with Cowork sessions for unexpected file modifications.
- Rotate exposed credentials: Any SSH keys, API tokens, or cloud credentials stored in user home directories should be considered compromised and rotated.
- Monitor namespace activity: Use endpoint detection tools to flag unusual user/network namespace creation and tc/act_pedit kernel calls on macOS hosts.
- Track vendor patch status: Follow Anthropic’s security advisories for a dedicated fix addressing the VirtioFS read-write mount design flaw.