Anthropic's Claude Cowork Sandbox Escape Disclosed: Researchers Demonstrate Path to Host Filesystem Access
Key Takeaways
- ▸The attack required precise alignment of multiple components: kernel namespace features, a June 2026 Ubuntu CVE, an unhardened daemon process, and shared filesystem architecture—a reminder that sandbox security depends on every layer.
- ▸The shared host filesystem `/mnt/.virtiofs-root` was designed to be accessible only to guest-root, but privilege escalation via kernel module exploitation made it readable and writable, compromising the entire attack surface.
- ▸Anthropic has addressed the vulnerability by shifting Cowork to cloud execution by default, eliminating the local VM escape vector entirely.
Summary
Security researchers discovered a critical vulnerability in Anthropic's Claude Cowork that allowed an AI agent to escape the Linux sandbox and gain unauthorized access to the host machine's filesystem. The vulnerability, dubbed "SharedRoot," exploited a complex chain of factors: unprivileged user namespace creation, a known Linux kernel CVE (CVE-2026-46331) in the traffic control act_pedit module, an unhardened root daemon, and the design decision to mount the host filesystem read-write inside the VM at /mnt/.virtiofs-root. The attack began with a standard agent session but escalated through privilege escalation to ultimately access files across the entire host.
The vulnerability was responsibly disclosed to Anthropic and classified as "Informative." Notably, the researchers found that Cowork's layered defense—featuring a real VM, unprivileged session user, seccomp filter, and brokered mount layer—held in most places but failed at critical junctures where multiple assumptions aligned. The flaw highlights the inherent difficulty of sandboxing AI agents, especially when untrusted inputs are a core use case. Anthropic has since mitigated the issue by defaulting Cowork to cloud execution, making this particular local escape path inaccessible.
- The disclosure underscores the tension between agent usability (needing to read user files) and security boundaries (ensuring those boundaries hold against sophisticated exploitation chains).
