Privacy by Editorial Team

Claude Cowork's SharedRoot escape: a one-prompt path to your Mac

Accomplish's Oren Yomtov chained CVE-2026-46331 to escape Claude Cowork's macOS sandbox in a single short message and reach the host filesystem.

A close-up of source code on a backlit monitor in a darkened room, evoking the AI-agent session in which the SharedRoot sandbox escape began.
Photo via Unsplash

If you connect a folder to a fresh Claude Cowork session on macOS and ask the agent for one short piece of help, the agent should not be able to read your SSH keys. On the version of Cowork that ran locally on the Mac, it could. Security researcher Oren Yomtov of Accomplish chained a public Ubuntu kernel bug, an autoloaded network-scheduling module, and a single misconfigured mount to walk from a normal Cowork prompt to read-write access on the entire host filesystem. About 500,000 macOS users running local Cowork sessions were affected prior to it being patched, The Hacker News reports. Anthropic closed the report as “informative without issuing a fix” and changed the product default to cloud execution instead. The SharedRoot disclosure arrives on top of the file-stealing vulnerability we covered in Claude Cowork’s February launch write-up, and the same sandbox-design instinct - treat the agent as untrusted by default - is the design goal the IronCurtain sandbox was built around, according to a close read of the framework.

The chain, in six moves

The escape - which Accomplish calls SharedRoot - does not need a malicious prompt, a malicious dataset, or even a malicious user. It needs an unprivileged session inside Cowork’s own Linux VM, which is what every Cowork session already is. Yomtov writes that “we connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox” (Accomplish).

The first three moves set up the capability that makes the bug reachable:

  1. Get capabilities. unshare creates a user namespace in which the session user is root with CAP_NET_ADMIN. Unprivileged user namespaces were enabled on the Cowork guest.
  2. Reach vulnerable code. Inside the new namespace, the agent opens a netlink socket and configures a Traffic Control action that references the act_pedit kernel module. The Cowork seccomp filter allows that netlink path, and mentioning act_pedit causes the kernel to autoload the module. Yomtov is blunt about the role of the namespaces: “There is no exploit in this step at all. It’s a kernel feature that could have been turned off, but left on” (Accomplish).
  3. Get a write primitive. The agent exploits CVE-2026-46331, a public Ubuntu bug from June 2026 in the act_pedit copy-on-write path. The bug lets the session user poison the page cache of a root-owned helper binary it can read but not write. The on-disk bytes are unchanged; only what runs from memory is changed.

The last three moves turn that primitive into a full host escape:

  1. Become guest-root. The Cowork host daemon coworkd, running as root inside the VM, re-execs the poisoned helper binary. Because coworkd is already root, the standard NoNewPrivs flag has nothing to bite on. The session user is now guest-root.
  2. Reach the host filesystem. Cowork mounts the entire host / into the VM at /mnt/.virtiofs-root, read-write, visible only to VM root. As Yomtov describes it: “the entire host ’/,’ mounted so that only guest-root inside the VM can see it” (Accomplish).
  3. Read and write the host. Once guest-root touches /mnt/.virtiofs-root, the agent has the same filesystem access as the logged-in Mac user. Per The Hacker News, that includes SSH keys and cloud credentials, with no permission prompt required, because the host sees a normal local process.

That is one short message in, host SSH keys out.

Why Anthropic closed it as “Informative”

Reporting a sandbox escape is not the same as getting it fixed. Anthropic closed the Accomplish report as Informative because CVE-2026-46331 “fell within [the] bounty program’s 30-day window for recently published bugs” and the surrounding hardening items were read as “defense-in-depth rather than standalone vulnerabilities” (Accomplish). The CVE itself was inside the program’s exclusion window; the supporting design problems - permissive seccomp, autoload of unused modules, the entire / exposed read-write - were treated as defense-in-depth.

The product-side response is more concrete. “The latest version of Cowork defaults to cloud execution,” The Hacker News reports, and Accomplish confirms that “Cowork now uses cloud execution by default, and this local escape path does not appear to apply there” (Accomplish). Users who deliberately opt back into local execution on the Mac are still exposed.

Why patching the next N-day will not be enough

Accomplish’s substantive argument is not about this one CVE. It is about the speed at which the next one will arrive. Yomtov says it directly: “Patch this one and you’ve fixed this one. The chain re-arms on the next one, with everything above the kernel untouched” (Accomplish). The Accomplish write-up also notes that “mainline-kernel privilege-escalation advisories ran around 2.3x the prior year, with early 2026 looking like the new baseline rather than a spike” (Accomplish). Once an LLM can read a CVE write-up and pick the right kernel module to autoload, time-to-exploit on a public bug collapses from weeks to minutes.

If patching cannot keep up, the only durable answer is to take the untrusted surface away. Accomplish recommends four design moves, none of which depend on which CVE shows up next:

  • Disable unprivileged user namespaces on the guest (apparmor_restrict_unprivileged_userns=1 or kernel.unprivileged_userns_clone=0). Without a user namespace, the agent cannot gain CAP_NET_ADMIN without already being privileged.
  • Tighten the seccomp filter to a default-deny that blocks unshare, setns, and clone3, rejects namespace-creating clone flags, and restricts socket() to an AF allowlist that excludes AF_NETLINK. The autoload primitive depends on a netlink socket the filter currently allows.
  • Stop autoloading unused modules. An install ... /bin/false line for act_pedit and similar modules keeps them off the running kernel, which keeps the next act_pedit-class CVE from being reachable in the first place.
  • Stop sharing the entire host /. Scope the virtiofs mount to the connected folders only, and mount it read-only. If the agent cannot see SSH keys, the chain has nothing to read at the end.

Each of these removes a step in the chain. Together, they turn the sandbox from “patchable against a known CVE” into “the chain cannot start.” That is the level Accomplish argues AI-agent sandboxes have to operate at from now on.

What This Means

If you use Claude Cowork on a Mac, accept the cloud default. Local execution on a Mac gives the agent direct access to your desktop user’s filesystem, and the SharedRoot chain showed how thin the line between an unprivileged Cowork session and the contents of ~/.ssh can be. If you have a security or compliance reason to keep local execution on, the four design changes above are the bar the local sandbox needs to clear before it is trustworthy again.

For anyone shipping an AI agent that touches the host filesystem, the takeaway is the same one Accomplish’s disclosure keeps returning to. Patching the next kernel CVE will not keep pace with AI-assisted vulnerability research. A design that gives the untrusted agent the capability to load privileged kernel modules, and then hands it the entire host filesystem, has already lost; the only question is which CVE gets there first.

The Bottom Line

A single short prompt to Claude Cowork was enough to read the user’s SSH keys. Anthropic closed the report as Informative and moved Cowork to a cloud default; the local sandbox needs design-level fixes before it is safe to use again.