Anthropic’s Claude Cowork Sandbox Flaw Exposes Mac Files

The issue isn’t theoretical. It’s a real pathway from a confined AI sandbox to your SSH keys, cloud credentials, and browser data. There’s no evidence of exploitation in the wild yet, but the window was open long enough to matter.

How the Attack Actually Worked

Claude Cowork runs AI agents inside a Linux virtual machine on your Mac. The agent itself runs as an unprivileged user, which sounds safe. But Cowork also runs a separate service called coworkd with root privileges to manage shared files.

Here’s where it breaks: The virtual machine contained a read-write mount of your Mac’s filesystem. Accomplish AI found a way to weaponize CVE-2026-46331, a Linux kernel flaw involving copy-on-write handling. By exploiting this bug, they could replace a file executed by the root-level coworkd service, giving the Cowork session root access inside the guest operating system.

Once you have root inside the virtual machine, that read-write mount becomes your attack surface. Anthropic’s sandbox didn’t break. The filesystem bridge between the VM and your Mac did.

What Files Were Actually at Risk

With access to your Mac’s filesystem, an attacker could read or modify:

• SSH private keys for server access
• Cloud credentials and API tokens
• Browser data and cookies
• Local configuration files with sensitive information

The actual impact depended on which user ran Cowork and what macOS protections were in place. Anthropic’s decision to classify the report as “Informative” rather than critical suggests they assessed the real-world risk as limited, though they haven’t explained that reasoning publicly.

Anthropic’s Response and Timeline

The company’s primary defense was making cloud execution the default for Cowork on July 7. By default, Cowork now runs on Anthropic’s servers rather than your Mac. Desktop users could still opt into local processing, which is why SharedRoot remains relevant for anyone who chose that configuration.

Anthropic has not publicly disclosed a patch for the underlying vulnerability. The fix is architectural: don’t run untrusted agents locally.

What You Should Do Now

If you use Claude Cowork, your immediate priorities are straightforward:

1. Use cloud execution by default. This bypasses the virtual machine vulnerability entirely. It’s now the default setting.
2. Limit folder access. If you do use local processing, grant Claude access only to the specific folders it needs. Never connect directories containing SSH keys, credentials, or sensitive data.
3. Rotate credentials. If you ran local Cowork sessions with untrusted files before July 23, rotate any potentially exposed credentials as a precaution.
4. Think twice about agent permissions. AI agents with access to terminal commands or system files can affect your wider system. Be selective.

The Bigger Picture

SharedRoot highlights a core tension in AI agent design: sandboxes that are too strict become useless, but sandboxes that are too permissive create vulnerabilities. Accomplish AI’s recommendations are sensible but reactive. They suggest mounting only user-approved folders as read-only when possible and adding stronger protections for privileged services.

The real lesson is that running AI agents locally on consumer machines introduces attack surface that cloud execution avoids entirely. Anthropic’s decision to make cloud execution the default was the right call. For users who need local processing, the burden is now on them to architect their own security carefully.

This won’t be the last vulnerability in AI agent sandboxes. As these tools mature, security will remain a constant game of catch-up.