Claude Cowork Sandbox Escape Exposes Mac Files

According to Accomplish AI's originating technical disclosure, the Cowork session began as an unprivileged guest user. The researchers used an unprivileged user namespace to reach the Linux traffic-control path affected by CVE-2026-46331, poisoned a root-owned helper and obtained root inside the guest.

Guest root then exposed the more consequential design choice: the Mac host filesystem was mounted read-write inside the VM at a location visible to guest root. That allowed the researchers to read and write files as the logged-in Mac user, beyond the folder the user had deliberately shared with Cowork.

The disclosure is a demonstrated local-session chain, not evidence that every Cowork task was exploited or that attackers used it in the wild. Accomplish AI says it reported the issue to Anthropic, which classified the submission as informative. The researchers also state that Cowork now uses cloud execution by default and that this local escape path does not appear to apply to the cloud default.

The Linux CVE supplied the route to guest root, but the host mount determined the blast radius. A guest privilege escalation would have been less damaging if root inside the VM could see only the folders the user had selected, or if the broader host mount were unavailable or read-only.

That is the practical lesson for teams deploying local agents. A VM should be treated as one containment layer, not the whole trust boundary. Mount scope, privilege brokers, kernel-module exposure, namespace policy and seccomp rules all affect whether a guest compromise stays inside the guest.

Teams using local execution should confirm which mode is active, keep the desktop application and guest image updated, restrict connected folders, and avoid placing unnecessary credentials in the agent's reachable environment. Those steps reduce exposure, but they do not substitute for a product-level fix to the underlying containment design.