Critical Sandbox Escape Vulnerability Discovered in Anthropic's Claude Cowork
Key Takeaways
- ▸Claude Cowork's local VM sandbox could be escaped through a multi-stage vulnerability chain combining kernel bugs, user namespace escape, and architectural design issues
- ▸Successful exploitation granted unrestricted read-write access to the host macOS filesystem, exposing all user files and credentials
- ▸Anthropic mitigated the vulnerability by defaulting Claude Cowork to cloud execution, rendering the local escape path obsolete
Summary
Security researchers have disclosed a critical vulnerability chain (CVE-2026-46331) that enables a complete escape from the sandbox in Anthropic's Claude Cowork local execution mode. By exploiting a combination of kernel bugs and architectural design decisions, an agent running as an unprivileged user inside the Linux VM could escalate to root and gain full read-write access to the host macOS filesystem, potentially compromising SSH keys, cloud credentials, and other sensitive files.
The exploit chain, named "SharedRoot," leverages multiple layers: the agent creates a new user namespace to gain Linux capabilities (CAP_NET_ADMIN); uses those capabilities to load the vulnerable act_pedit kernel module via traffic-control configuration; exploits CVE-2026-46331 ("pedit COW") to poison the page cache of a root-owned binary; and then triggers privilege escalation when the unprivileged coworkd daemon re-execs that poisoned binary. Once root inside the guest, the attacker accesses /mnt/.virtiofs-root, the host filesystem mounted read-write into the VM.
Anthropic received the vulnerability report through responsible disclosure and closed it as 'Informative.' The company has mitigated the issue by defaulting Claude Cowork to cloud execution instead of local VMs, a shift that eliminates this particular attack surface entirely.
- The incident underscores the inherent difficulties in sandboxing untrusted code and the necessity of defense-in-depth security architecture
Editorial Opinion
This security disclosure reveals a fundamental tension in agent-based products: the core value proposition of running untrusted AI on user-provided data conflicts with the practical difficulty of achieving bulletproof sandboxing. While Anthropic's pivot to cloud execution is pragmatic, it shifts security concerns from architectural sandboxing to cloud platform trust and network transparency. The incident demonstrates that layered security approaches—even carefully designed ones—can be defeated by unexpected interactions between components.
