SharedRoot: escaping the Claude Cowork sandbox on a Mac
Researchers mounted a single folder into a fresh Claude Cowork session, sent one short message, and reached files on the host Mac well outside that folder, with no permission prompt at any point. SSH keys, cloud credentials, anything the user’s account can touch was all reachable.
Cowork runs the agent inside a Linux VM as an unprivileged user, but the entire host disk is mounted into the VM with write access. A chain through namespaces, the act_pedit module, and CVE-2026-46331 (an Ubuntu bug published in June) gets root inside the VM, and from there, direct access to host files.
The report went to Anthropic, which closed it as “Informative.” Cowork now defaults to cloud execution, where this local escape path doesn’t apply.
Up next
A Claude Opus 5 model string showed up in Google’s Vertex catalog
A Claude Opus 5 model string turned up in Google Vertex’s quota catalog, per Testing Catalog, after a research entry flashed in a coding tool: 1M token context, a high-compute mode, and an Opus 4.8 fallback. No pricing or system card yet.
Related stories
- A Claude sandbox memory dump yielded a valid Google token
- Claude Desktop turned into a C2 agent via configuration poisoning
- Claude Cowork sandbox bypass allows root code execution
- Apiiro finds Claude Code secrets in 1,122 GitHub files
- Email leak stopgap in Claude Code checks only shell calls
- Claude Code agent sat on a Pentagon network for two months
Comments
No comments yet. Be the first.
Join the conversation
Sign in to leave a comment. It appears after moderation.