SharedRoot: a Claude Cowork agent escaping its sandbox

Researchers at Accomplish AI have detailed a vulnerability named SharedRoot (CVE-2026-46331) in Anthropic’s Claude Cowork. It let an AI agent break out of the Linux virtual machine it runs in and read or write files anywhere on the host Mac. It is a textbook example of a risk we have long written about: an agent’s sandbox is a security boundary — until it breaks.

We present the facts neutrally: both the researchers’ findings and the vendor’s response.

What the researchers found

According to Accomplish AI, the flaw affected local Claude Cowork sessions and made it possible to gain root in the guest environment and then reach the host’s files. The scope prior to the fix covered about 500,000 macOS users running Cowork locally. The level of access is the key point: the agent could read any data accessible to the user’s account — including SSH keys and cloud credentials.

The best illustration is a quote from Accomplish AI principal researcher Oren Yomtov: “We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox.” It shows no elaborate chain was needed — one interaction was enough.

The vendor’s response

This matters for the full picture: after disclosure, Anthropic closed the report as “informational” — that is, it did not treat it as a vulnerability requiring a separate fix. The reason is practical — the latest version of Cowork defaults to running tasks in the cloud, which addresses the local sandbox-escape issue. In other words, the architectural change (moving execution off the user’s local machine) removes this vector, even without a dedicated patch to the mechanism itself.

One can debate the classification, but the technical takeaway is independent of it: a local agent with file access is a powerful surface that is hard to isolate.

Why it matters to anyone deploying agents

SharedRoot is not one product’s problem — it illustrates a general principle. An agent given filesystem access and running in a sandbox is exactly as safe as that sandbox is tight. If the isolation breaks, the agent inherits the user’s privileges: keys, tokens, secrets. It is the same problem we describe in AI and LLM security in business — a model can reason brilliantly and still become a channel to your data.

The “connect a folder, send a message” vector is especially instructive: it shows that merely granting access to a directory can be a bigger security decision than it looks.

What to do

1. Treat the agent sandbox as a boundary, not a guarantee. Assume isolation can fail, and limit what the agent can see at all.
2. Do not run local agents on accounts holding the crown jewels. Keep SSH keys, cloud credentials and secrets out of reach of the account the agent runs under.
3. Prefer execution in an isolated environment. Running in a separated space (rather than a personal workstation with full access) reduces the blast radius of a successful escape — exactly as the move to the cloud did here.
4. Minimise the scope of shared folders. Connect only what the task needs, not your whole home directory.
5. Keep agent tooling updated. The agent ecosystem changes fast; use the latest versions and track changes to default security settings.

The bottom line

SharedRoot is a valuable reminder that the boundary between an agent and your files is only as strong as its weakest isolation mechanism. Whatever the report’s classification, the practical takeaway does not change: limit access, isolate execution, and do not mix agents with accounts full of secrets. If you are deploying agents and want to design their isolation, get in touch.

Sources: The Hacker News, Accomplish AI — SharedRoot.