Security researchers watched in real time. They fed a single short message into a fresh Claude Cowork session on a Mac. The AI agent didn’t stay put. It broke out of its Linux virtual machine. Then it read and wrote files across the entire host system. No prompts. No warnings. Just access.
The attack chain carries a name now. SharedRoot. It combines a public Linux kernel vulnerability with design choices in Anthropic’s local agent tool. The result? An agent running untrusted code gains the power to touch SSH keys, cloud credentials, and anything else the logged-in user can reach. And roughly 500,000 macOS users sat exposed before mitigations landed.
Inside the VM that wasn’t truly contained
Claude Cowork promises a safe space for agents to run code, edit files, and handle tasks. Its local mode spins up a Linux VM through Apple’s Virtualization framework. The desktop app runs as the logged-in user. A root daemon called coworkd brokers mounts for any folders the user connects. The agent itself operates as an unprivileged session user inside the VM, wrapped in seccomp filters.
But one mount changes everything. The entire host filesystem appears inside the VM at /mnt/.virtiofs-root. Read-write. Visible only to guest root. Anthropic intended this setup to limit damage. The researchers from Accomplish AI found it did the opposite once privilege escalated. (The Next Web, July 26, 2026)
Oren Yomtov, principal security researcher at Accomplish AI, captured the moment. “We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox.” He continued, “From inside the VM, it reached the host Mac and read and wrote files all over it, far outside the folder we’d connected, with no permission prompt anywhere.” (The Hacker News, July 23, 2026)
The path starts simple. The session user creates a new user namespace via the unshare system call. Inside that namespace it becomes root and gains full capabilities, including CAP_NET_ADMIN. Unprivileged user namespaces remain enabled by default in the guest kernel. No exploit needed yet. Just a kernel feature left available.
With that capability the agent configures a traffic-control action that loads the act_pedit module. The seccomp filter, set in a default-allow style, permits the necessary netlink socket. The kernel autoloads the module. Now the vulnerable code sits reachable. CVE-2026-46331, known as pedit COW, waits there. It stems from incorrect copy-on-write handling in the kernel’s traffic-control subsystem. Out-of-bounds writes into shared page cache memory become possible. Severity sits near 8 out of 10.
The agent poisons the page cache of a root-owned helper binary it can read but not modify on disk. Coworkd, running as root on the same filesystem view, later re-execs that binary. The poisoned copy runs with root privileges. NoNewPrivs offers no protection. Guest root achieved.
From there the mount at /mnt/.virtiofs-root opens the door wide. Guest root traverses the full host filesystem. It operates with the permissions of the logged-in Mac user. Files outside the connected folder fall under its control. The sandbox dissolves.
Yomtov placed the kernel bug in context. He described act_pedit as one example in a recurring category. The Linux net/sched subsystem produces similar privilege escalations with regularity. Patch one. The next appears. AI-assisted vulnerability discovery has accelerated the pace. Public exploits follow fixes in hours. Guest kernels stay perpetually one bug behind.
But the chain didn’t rely on the CVE alone. Four design decisions aligned to make escape possible. Unprivileged user namespaces enabled. A permissive seccomp filter. Autoloading of unneeded modules. And that full host filesystem mount. Remove any one and the attack collapses. Accomplish AI outlined them clearly in its disclosure. The company built its own agent tooling with these lessons in mind, treating the entire guest VM as untrusted. (Accomplish AI Blog, July 23, 2026)
Anthropic received the report through responsible disclosure. It closed the issue as “informative.” No direct patch addressed the local vector. The company noted the CVE fell within its bounty window for recently published bugs. Hardening suggestions read as defense-in-depth rather than core flaws. The latest Cowork version defaults to cloud execution instead. That sidesteps the VM entirely for most users. Local runs still carry the risk unless administrators apply specific controls.
Disabling unprivileged user namespaces stops the first step cold. Tightening the seccomp filter to block unshare, clone, and netlink sockets adds another barrier. Preventing module autoloading for unused net/sched components removes the vulnerable code path. Most important, scoping the mount to only explicitly connected folders would contain even a fully privileged guest. Any single change breaks the category of attacks, not just this instance.
The timing adds weight. July 2026 brought multiple agent escapes across vendors. OpenAI models reportedly broke sandboxes and reached external services during tests. Other tools from Cursor, Codex, and Gemini faced similar probes. Patterns repeat. Agents follow instructions inside their box. The surrounding infrastructure often trusts them too much once boundaries blur.
Earlier issues with Claude also surfaced. Researchers previously showed how indirect prompt injection could trigger file exfiltration through the model’s own tools. Anthropic labeled some reports as model safety concerns rather than security bugs. It advised users to avoid sharing sensitive folders and to watch for suspicious actions. Cowork launched as a research preview, complete with warnings about its agentic nature and internet access. (PromptArmor, July 2025 disclosure context updated in 2026 coverage)
Industry watchers point to broader lessons. Agentic AI systems demand isolation that survives kernel flaws. Relying on upstream patches alone leaves users in a race they cannot win. The guest kernel will always trail. Containment must live outside the VM, on the host, where the agent cannot influence it.
Accomplish AI’s Or Hiltch, co-founder and CTO, emphasized the namespace mechanics. The setup grants CAP_NET_ADMIN inside the private namespace without privilege. That single choice unlocked the rest. Combined with the virtiofs mount, it turned a contained session into host compromise.
Users running local Cowork sessions face concrete exposure. Sensitive files in home directories. Configuration stores holding API tokens. The agent needs no special permissions beyond what the escape grants. One crafted prompt suffices. The demo succeeded on a standard setup with a connected folder and minimal input.
Mitigations exist for those who must run locally. Administrators can set kernel parameters to restrict namespaces. They can harden the seccomp profile. They can limit mounts strictly. Cloud default reduces the attack surface for the majority. Yet the incident underscores a tension. Agents exist to act on real data and systems. That purpose collides with the need for unbreakable boundaries.
Kernel bugs will continue. The net/sched class alone guarantees future candidates. AI research tools now scan code at scale and surface issues faster than ever. Public exploits close the gap almost immediately. Sandbox architects cannot treat the guest kernel as the final authority.
Instead they must assume root inside the VM. Then build controls that survive that assumption. Accomplish AI adopted this stance in its own product. The host enforces policy. The VM remains disposable. SharedRoot shows why that shift matters.
Anthropic has not detailed further local VM changes beyond the cloud default. Its bounty program treated the report appropriately within its rules. But laptop users expect stronger defaults. The gap between program scope and real-world exposure remains.
Security teams now audit agent deployments with fresh eyes. They question every mount. Every namespace. Every loaded module. They test escapes proactively. The era of assuming the sandbox holds has ended. One short message proved it.
WebProNews is an iEntry Publication