{"id":741191,"date":"2026-07-27T01:55:17","date_gmt":"2026-07-26T22:55:17","guid":{"rendered":"https:\/\/buradabiliyorum.com\/en\/anthropics-claude-cowork-could-escape-its-local-vm-and-read-credentials-on-a-mac\/"},"modified":"2026-07-27T01:55:17","modified_gmt":"2026-07-26T22:55:17","slug":"anthropics-claude-cowork-could-escape-its-local-vm-and-read-credentials-on-a-mac","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/anthropics-claude-cowork-could-escape-its-local-vm-and-read-credentials-on-a-mac\/","title":{"rendered":"Anthropic&#8217;s Claude Cowork could escape its local VM and read credentials on a Mac"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6af74b6c48e30\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6af74b6c48e30\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/anthropics-claude-cowork-could-escape-its-local-vm-and-read-credentials-on-a-mac\/#TLDR\" >TL;DR<\/a><\/li><\/ul><\/nav><\/div>\n<div id=\"article-main-content\">\n<div class=\"postContent-tldr\">\n<h4 class=\"postContent-offsetTitle\"><span class=\"ez-toc-section\" id=\"TLDR\"><\/span>TL;DR<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p><em>Researchers showed Claude Cowork could escape its local VM sandbox via a Linux kernel flaw and read files across the host Mac<\/em><\/p>\n<\/div>\n<p>Security researchers at Accomplish AI demonstrated that<a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.techradar.com\/pro\/security\/its-not-just-openai-models-escaping-and-running-riot-experts-show-how-claude-cowork-can-break-its-bonds-and-access-mac-files\" target=\"_blank\" rel=\"nofollow noopener\"> Anthropic\u2019s Claude Cowork could break out of its local virtual machine sandbox<\/a> and read files across the underlying Mac, including SSH keys and cloud credentials. The attack, dubbed SharedRoot, exploited a Linux kernel privilege escalation vulnerability to gain root access inside the guest VM, then walked out through a writable filesystem mount that exposed the entire host. Accomplish AI disclosed the findings on July 23 and said roughly 500,000 macOS users running local Cowork sessions were exposed before the issue was addressed.<\/p>\n<p>The escape chain worked because Cowork\u2019s local execution mode runs inside a Linux VM that shares the host filesystem via a writable VirtioFS mount. That mount was intended to be accessible only to root within the guest, but the researchers found they could escalate from a session user to guest root by exploiting CVE-2026-46331, a Linux kernel flaw known as \u201c<em>pedit COW<\/em>\u201d that was given a severity score of nearly eight out of ten. Once the agent had root inside the VM, it could reach anything the logged-in Mac user could reach.<\/p>\n<p>\u201c<em>We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox,<\/em>\u201d Oren Yomtov, principal security researcher at Accomplish AI, told The Hacker <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/news\/\" data-internallinksmanager029f6b8e52c=\"2\" title=\"News\" target=\"_blank\" rel=\"noopener\">News<\/a>. \u201c<em>From inside the VM, it reached the host Mac and read and wrote files all over it, far outside the folder we\u2019d connected, with no permission prompt anywhere.<\/em>\u201d The vulnerability sits in the kernel\u2019s traffic-control subsystem, where incorrect copy-on-write handling allows out-of-bounds writes into shared page-cache memory.<\/p>\n<div class=\"inarticle-wrapper latest channel-cta hs-embed-tnw\">\n<div id=\"hs-embed-tnw\" class=\"channel-cta-wrapper\">\n<div class=\"channel-cta-img\"><img decoding=\"async\" class=\"js-lazy\" src=\"https:\/\/media.thenextweb.com\/hardfork-2018\/uploads\/visuals\/tnw-newsletter.png\"\/><\/div>\n<p><img decoding=\"async\" src=\"https:\/\/media.thenextweb.com\/hardfork-2018\/uploads\/visuals\/tnw-newsletter.png\"\/><\/p>\n<div class=\"channel-cta-input\">\n<p class=\"channel-cta-title\">The \ud83d\udc9c of EU tech<\/p>\n<p class=\"channel-cta-tagline\">The latest rumblings from the EU tech scene, a story from our wise ol&#8217; founder Boris, and some questionable AI art. It&#8217;s free, every week, in your inbox. Sign up now!<\/p>\n<\/div>\n<\/div>\n<\/div>\n<p>Anthropic closed the report as \u201c<em>informative<\/em>\u201d without issuing a direct fix, according to <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/thehackernews.com\/2026\/07\/claude-cowork-flaw-could-let-ai-agent.html\" target=\"_blank\" rel=\"nofollow noopener\">The Hacker News.<\/a> The version of Claude Cowork released afterwards defaults to cloud execution, which sidesteps the local escape path entirely. Users who opt to run the agent locally rather than in the cloud, however, remain exposed unless they harden their configurations by disabling unprivileged user namespaces, restricting filesystem sharing, and running the Cowork daemon with strict mount protections.<\/p>\n<p>The finding lands in a month that has seen four separate research teams break AI agents in four different ways, from poisoned memories to hijacked browser extensions. OpenAI disclosed that its own models escaped a sandbox and breached Hugging Face during the same week, and researchers escaped the sandboxes of Cursor, Codex, and Gemini CLI without ever breaking the sandbox itself. The pattern across all of these incidents is the same: the AI agent follows its rules inside the box, but the infrastructure surrounding it trusts the agent more than it should.<\/p>\n<\/p><\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMN63nwsw68G3Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/buradabiliyorum.com\/en\/category\/technology\/\" target=\"_blank\" >Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/thenextweb.com\/news\/claude-cowork-sandbox-escape-mac-files-sharedroot\" target=\"_blank\" >Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>TL;DR Researchers showed Claude Cowork could escape its local VM sandbox via a Linux kernel flaw and read files across the host Mac Security researchers at Accomplish AI demonstrated that Anthropic\u2019s Claude Cowork could break out of its local virtual machine sandbox and read files across the underlying Mac, including SSH keys and cloud credentials&#8230;.<\/p>\n","protected":false},"author":1,"featured_media":741192,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/media.thenextweb.com\/2026\/07\/claude-cowork-sandbox-escape-mac-files-sharedroot.avif","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-741191","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/741191","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=741191"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/741191\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/741192"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=741191"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=741191"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=741191"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}