Researchers at Accomplish AI discovered a serious sandbox escape bug, dubbed SharedRoot, in Anthropic’s Claude Cowork — an AI agent tool that runs inside a Linux virtual machine on macOS. By exploiting CVE-2026-46331 (a kernel flaw known as “pedit COW” in the Linux act_pedit network module), an attacker or a misbehaving AI session could obtain root access inside the guest VM and then reach out to the Mac’s full file system — reading or writing files anywhere on your computer, far beyond the folder you’d shared with the agent. Researchers demonstrated the attack with a single short prompt: “We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox.”
Anthropic has patched the issue and pushed an automatic update. No evidence of exploitation in the wild has been reported. This story is a reminder that AI coding assistants aren’t just convenient productivity tools — when they run code locally, the security of their sandbox matters as much as the security of any other process on your computer.
How to check if you’re affected
Affected versions of Claude Cowork are those released before the patch for CVE-2026-46331. If you run Claude Cowork on a Mac, open the application and check your current version in the About screen or Help menu. An auto-update should have already applied the fix; if your version still shows as outdated, restart the app or download the latest release from Anthropic’s official site. Around 500,000 macOS users running local Claude Cowork sessions were potentially exposed prior to the patch.