Overview
- Security researchers at Accomplish AI demonstrated that a locally running Claude Cowork session could break out of its Linux virtual machine and read and write files on the host Mac, with the demonstration reported on July 23.
- The escape chain used a Linux kernel privilege‑escalation (CVE-2026-46331), a writable VirtioFS host mount inside the VM, and a privileged coworkd service that was coerced to execute a modified file to gain guest root.
- If exploited, the agent could access data available to the logged‑in user, including SSH private keys, cloud credentials, and browser files, creating a risk of credential theft or data exfiltration.
- Anthropic moved Cowork to cloud execution by default on July 7 to remove the local VM path but local processing remains an option and users who run it must apply hardening or avoid mounting sensitive folders.
- Accomplish AI advised scoping mounts to specific folders, mounting them read‑only, disabling unprivileged user namespaces, running coworkd with strict mount protections, and rotating exposed credentials; researchers reported no evidence of SharedRoot being used in the wild and estimated about 500,000 affected local sessions before the change.