- Accomplish AI demonstrated that Claude Cowork was able to escape a VM sandbox via Linux zero-day CVE-2026-46331
- The agent accessed the Mac host’s files, risking leaks of SSH keys, cloud credentials, and more
- Anthropic switched Cowork to default running in the cloud; Local users should tighten settings to mitigate exposure.
Recent news that a ChatGPT agent escaped from the sandbox and attacked Internet services raised quite a few eyebrows, but it seems he’s not the only one capable of going crazy. Security researchers Accomplish AI say they achieved similar results with Anthropic’s Claude Cowork.
In a new report, researchers said they ran a local session on a Mac-hosted virtual Linux machine and then watched as the agent broke free from the VM and began reading and writing files on the underlying system.
“We connected a folder to a new Claude Cowork session, sent a short message, and saw the agent escape from the sandbox,” said Oren Yomtov, senior security researcher at Accomplish AI. Hacker News. “From inside the virtual machine, it would reach out to the Mac host and read and write files everywhere, far outside the folder we had connected, without asking permission anywhere.”
Latest videos ofTechnologyRadar
Defaults to cloud execution
This means that, in theory, the agent can be used to access or extract anything stored in the Mac user account, including SSH keys, cloud credentials, and more. To exit the sandbox, the agent exploited CVE-2026-46331 (“pedit COW”), a privilege escalation vulnerability in the Linux kernel. This bug, fixed in mid-June of this year, received a severity score of 7.8/10 (high).
Accomplish AI disclosed these findings to Anthropic, which reportedly acknowledged them but did not issue a direct fix. However, the version of Claude Cowork that was subsequently released uses cloud execution by default, which the post claims fixes the issue. Still, users who choose to run the agent locally instead of in the cloud will still be exposed.
However, mitigations can be made. Users must disable unprivileged user namespaces, grant/revoke seccopm permissions, stop automatic loading of modules, and restrict host-wide sharing to the VM.
“Move it to the folders that were actually connected instead of all /, or at least mount it as read-only, and run coworkd with ProtectSystem=strict in its own mount namespace so that it doesn’t rerun binaries that a session user can poison,” Accomplish AI explained. “So even a full guest root has nothing to land on, the last two steps of the chain have nowhere to go.”
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
