Security researcher Oren Yomtov, Principal Security Researcher at Accomplish, disclosed a vulnerability on July 23, 2026 that let an AI agent running inside Anthropic's Claude Cowork escape its virtual machine sandbox and read or write files anywhere on the host Mac, including SSH private keys and cloud credentials. Yomtov named the attack path SharedRoot.
The flaw affected local Cowork sessions before Anthropic shifted the product's default execution mode to the cloud. Anthropic was notified of the issue but classified the report as informational and did not issue a targeted patch, instead pointing to the move to cloud-based execution as the mitigation for the local escape path.
What Happened: The SharedRoot Disclosure
Claude Cowork runs AI agent tasks inside a Linux virtual machine managed by Apple's Virtualization framework on macOS. Yomtov's research found that the VM exposes the entire host filesystem through a writable VirtioFS mount at /mnt/.virtiofs-root, meaning that a process able to escape the guest Linux environment could reach files far beyond what the sandbox was meant to isolate.
"Untrusted content in a Claude Cowork session can escape the VM it's sandboxed in and read and write files anywhere on your Mac," Yomtov wrote in the disclosure. That description captures the core risk: SharedRoot did not require a user to make a mistake, it could be triggered by content the AI agent processed during a normal session.
Key Details
The escape chain Yomtov documented involves six steps. First, an unprivileged user inside the guest VM creates a namespace, effectively becoming root within that local context. Second, this grants the CAP_NET_ADMIN capability. Third, the attacker configures a traffic-control action that loads the vulnerable act_pedit kernel module. Fourth, the chain exploits CVE-2026-46331, a page cache poisoning bug, to compromise a root helper binary. Fifth, privilege escalation is triggered when the coworkd process re-executes the now-poisoned binary. Sixth, and finally, the attacker gains access to the host filesystem mounted at /mnt/.virtiofs-root, which is where SSH keys, cloud credentials, and other sensitive files accessible to the logged-in Mac user could be reached.
Why It Matters
AI coding and productivity agents like Claude Cowork, alongside other autonomous AI agents already linked to security incidents, are designed to process untrusted content, web pages, files, code repositories, as part of their normal operation. A sandbox escape in that context is especially dangerous because the attack surface is not a user clicking a malicious link, it is the AI agent itself encountering and acting on content during a task it was assigned to complete.
Yomtov's report also highlights a structural problem with sandboxing AI agents: containment strategies that rely on a guest Linux kernel staying free of exploitable bugs are inherently fragile, since kernel vulnerabilities are discovered on an ongoing basis. As AI-assisted vulnerability research accelerates, that gap between when a sandbox is built and when a new kernel bug is found is likely to keep narrowing.
Industry Context
SharedRoot is part of a broader pattern of researchers, including those behind the AI-assisted discovery of the 15-year-old GhostLock Linux flaw, probing the security boundaries of AI agent products that execute code or process files on a user's behalf. As tools like Claude Cowork, and comparable agentic coding products from other vendors, gain the ability to run local tasks with elevated access to a user's machine, sandbox escapes represent one of the most consequential categories of vulnerability, since a single flaw can undermine the isolation the entire product model depends on.
Anthropic's response to the report, classifying it as informational rather than a standalone vulnerability requiring a dedicated patch, reflects a judgment call about severity versus the company's broader architectural shift. Anthropic noted that the CVE fell within its 30-day publication window and framed additional hardening measures as defense-in-depth improvements rather than fixes for a critical standalone flaw.
What It Means for Users and the Industry
For users who ran Claude Cowork with local execution before the shift to cloud-based sessions, the practical risk depended on whether they processed untrusted content, such as external code, files, or web content, during those local sessions. Anthropic's move to default cloud execution addresses the underlying exposure for new sessions, since the local VirtioFS mount that made the host filesystem reachable does not apply in the cloud execution model.
For the wider AI agent industry, SharedRoot is a reminder that agentic tools processing untrusted content need sandbox architectures that assume kernel-level bugs will eventually be found, rather than relying on the guest environment staying clean indefinitely. Vendors building similar local-execution AI agents are likely to face comparable scrutiny of their isolation boundaries as adoption grows.
What Happens Next
With Cowork now defaulting to cloud-based execution, the immediate exposure from the local VirtioFS mount described in SharedRoot no longer applies to new sessions using that mode. Security researchers are likely to continue probing both the cloud execution path and any remaining local execution options for similar containment weaknesses, given the pace of kernel-level bug discovery Yomtov's report highlighted.
Final Takeaway
SharedRoot demonstrates that even well-resourced AI companies face real challenges securing the sandboxes their agents run in, particularly when those agents are designed to process untrusted content as part of everyday use. Anthropic's shift to cloud-based execution addresses the specific escape path Yomtov disclosed, but the underlying lesson, that sandbox isolation for AI agents needs to assume kernel bugs will surface rather than hope they don't, applies well beyond this one product.
How the VirtioFS Mount Made the Escape Possible
The technical root of SharedRoot's severity was not just the kernel privilege escalation chain itself, but what became reachable once an attacker gained root inside the guest VM. Because the entire host filesystem was mounted inside the guest as a writable VirtioFS share at /mnt/.virtiofs-root, escalating privileges inside the sandbox was functionally equivalent to gaining access to the host Mac itself, rather than being contained to a disposable, isolated environment.
That design choice, mounting the full host filesystem with read-write permissions rather than a narrowly scoped folder, is what turned a local kernel exploit chain into a complete sandbox bypass. It is also the specific architectural decision that changes under Cowork's cloud execution model, where the AI agent no longer runs inside a VM with direct access to the user's local Mac filesystem in the first place.
FAQs
Sources and Verification
This article was reviewed as part of CapisTech's editorial fact-checking process.