Researcher Discovers Sandbox Escape Vulnerability in Claude Cowork's Local Execution
Key Takeaways
- ▸A multi-stage exploit chain allowed Claude Cowork agents to escape the local Linux VM sandbox and access the host macOS filesystem with full read-write privileges
- ▸The attack exploited an interplay of features (unprivileged user namespaces, permissive seccomp, CVE-2026-46331) rather than a single critical flaw, highlighting the difficulty of securing agent sandboxes
- ▸SSH keys, cloud credentials, and other sensitive host files were accessible to escaped agents with no user permission prompts
Summary
Security researcher aviramha disclosed a critical vulnerability in Claude Cowork's local execution environment that allows sandboxed agents to escape the VM boundary and access the host machine's filesystem. The exploit chain leveraged multiple privilege escalation techniques—including an unprivileged user namespace creation, a kernel module auto-load, and CVE-2026-46331 ("pedit COW"), a public Ubuntu buffer poisoning vulnerability—to ultimately grant guest-root access and read/write access to the entire host filesystem, including SSH keys and cloud credentials.
The attack required precise alignment of several security boundaries: the permissive seccomp filter in Cowork's guest environment, the unhardened coworkd root daemon, and the read-write mount of the host filesystem at /mnt/.virtiofs-root. The vulnerability exposed a fundamental tension in agent sandbox design: users need to pass untrusted inputs (repos, PDFs, files from others) to agents, yet the sandbox boundary is the only defense against exfiltration of sensitive data like credentials.
Anthropico was notified and classified the issue as "Informative." Critically, the company has since shifted Cowork's default execution model to cloud-based processing, making the local VM escape path no longer applicable to standard users. The vulnerability underscores the complexity of achieving true isolation in virtualized agent environments and the importance of defense-in-depth approaches.
- Anthropic responded by shifting Cowork to cloud-based execution by default, eliminating the vulnerable local VM path for most users
Editorial Opinion
This vulnerability highlights a sobering reality: sandboxing untrusted code is extraordinarily difficult, and agent systems that promise isolation need multiple, independently hardened layers. While Anthropic's response—deprecating local execution in favor of cloud infrastructure—is pragmatic, the underlying lesson cuts deeper: as AI agents gain filesystem and network access, even small oversights cascade into total boundary failure. The researcher's methodical chain-of-custody explanation is valuable for the community, but it also serves as a reminder that 'defense in depth' often means accepting that depth is necessary rather than architectural elegance alone.
