- Accomplish AI showed that Claude Cowork could escape a VM sandbox via Linux zero-day CVE-2026-46331
- The agent accessed host Mac files, risking the release of SSH keys, cloud credentials, and more
- Anthropically, Cowork switched to standard cloud execution; local users must harden configurations to mitigate exposure
The recent news of a ChatGPT agent that escaped the sandbox and attacked services on the Internet raised quite a few eyebrows, but it seems that it is not the only one capable of running amok. Security researchers Accomplish AI say they achieved similar results with Anthropic’s Claude Cowork.
In a new report, the researchers said they ran a local session in a Mac-hosted Linux virtual machine and then observed that the agent broke free from the VM and began reading and writing files on the underlying system.
“We connected a folder to a fresh Claude Cowork session, sent a short message, and watched the agent escape the sandbox,” said Oren Yomtov, principal security researcher at Accomplish AI. Hacker News. “From inside the VM, it reached the host Mac and read and wrote files all over the place, well outside the directory we had mounted, with no permission prompt anywhere.”
Latest videos fromTechRadar
Standard for cloud execution
This means that the agent can, in theory, be used to access or exfiltrate anything stored on the Mac’s user account, including SSH keys, cloud credentials, and more. To break out of the sandbox, the agent exploited CVE-2026-46331 (“pedit COW”), a Linux kernel privilege escalation vulnerability. This bug, which was fixed in mid-June of this year, received a severity score of 7.8/10 (high).
Accomplish AI disclosed these findings with Anthropic, which reportedly acknowledged them but did not issue an outright fix. However, the version of Claude Cowork that was released afterwards defaults to cloud execution, which according to the publication solves the problem. Still, users who choose to run the agent locally rather than in the cloud will remain exposed.
However, remedies are possible. Users should disable unprivileged user namespaces, grant/revoke seccopm permissions, stop auto-loading of modules, and restrict whole-host sharing within the VM.
“Scope it to the directories that were actually mounted instead of all /, or at least mount it read-only, and run coworkd with ProtectSystem=strict in its own mount namespace so it doesn’t replay binaries that a session user could poison,” explained Accomplish AI. “Then even a full guest root has nothing to land on, the last two steps in the chain have nowhere to go.”
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews and opinions in your feeds.
