- Accomplish AI showed that Claude Cowork could escape a VM sandbox via Linux Zero Day CVE‑2026‑46331
- The agent accessed the host’s Mac files, risking exfiltration of SSH keys, cloud credentials, and more.
- Anthropic has moved Cowork to cloud execution by default; local users should harden configurations to mitigate exposure
Recent news of a ChatGPT agent escaping the sandbox and attacking services across the internet has raised quite a few eyebrows, but it appears it’s not the only one capable of going on a rampage. Security researchers at Accomplish AI say they achieved similar results with Anthropic’s Claude Cowork.
In a new report, researchers said they ran a local session on a Mac-hosted Linux virtual machine, then observed the agent break free from the virtual machine and begin reading and writing files on the underlying system.
“We connected a folder to a new Claude Cowork session, sent a short message, and watched the agent escape the sandbox,” said Oren Yomtov, principal security researcher at Accomplish AI. Hacker news. “From inside the virtual machine, it reached into the host Mac and read and wrote files everywhere, well outside the folder we had connected, without any permission prompts. »
Latest videos fromTechRadar
By default, running in the cloud
This means that in theory the agent can be used to access or exfiltrate anything stored on the Mac’s user account, including SSH keys, cloud credentials, and more. To escape the sandbox, the agent exploited CVE-2026-46331 (“pedit COW”), an elevation of privilege vulnerability in the Linux kernel. This flaw, fixed in mid-June of this year, received a severity rating of 7.8/10 (high).
Accomplish AI disclosed these findings to Anthropic, which reportedly acknowledged them but did not issue a direct fix. However, Claude Cowork’s version subsequently released defaults to cloud execution, which the release claims fixes the issue. However, users who choose to run the agent locally rather than in the cloud will still be exposed.
However, mitigations are possible. Users should disable unprivileged user namespaces, grant/revoke seccopm permissions, stop automatic loading of modules, and restrict sharing of the entire host in the VM.
“Expand it to folders that were actually logged in instead of all /, or at least mount it read-only, and run coworkd with ProtectSystem=strict in its own mount namespace so it doesn’t re-execute binaries that a session user can poison,” Accomplish AI explained. “So even a full guest root has nothing to land on, the last two steps in the chain have nowhere to go.”
The best antivirus for every budget
Follow TechRadar on Google News And add us as your favorite source to get our news, reviews and expert opinions in your feeds.
