Security researchers discovered a critical security vulnerability in Anthropic's AI agent tool, Claude Cowork, which allows attackers to escape from a Linux virtual machine sandbox and read or write files anywhere on macOS, potentially affecting around 500,000 macOS users globally. This vulnerability could also enable attackers to obtain login credentials for online services, posing significant security risks.
Both layers of defense breached
Claude Cowork is an AI agent tool launched by Anthropic, which can access local files and folders and perform tasks on macOS after explicit user authorization. In terms of security protection, Anthropic set up two layers of restrictions: one is that Cowork runs in an isolated virtual machine, and the other is that it can only access files and folders authorized by the user. However, researchers from Accomplish AI discovered that developers can exploit this vulnerability to break through both layers of defense - allowing Cowork to escape from its running Linux virtual machine sandbox and directly access the host file system.
Technical details show that the virtual machine where Cowork is isolated runs with a writable VirtioFS mount point that shares the host file system. This mount point was originally only accessible by the root user inside the virtual machine, but researchers exploited the Linux kernel vulnerability numbered CVE-2026-46331 (codename "pedit COW", with a severity score close to a perfect 10 out of 10), elevating session user privileges to the virtual machine root user. Once the agent gains root privileges, it can access any resources that the logged-in macOS user can reach.
Risk of bypassing cloud execution, local users still need to be vigilant
After receiving the report, Anthropic marked it as "information-rich," but did not release a direct patch. The subsequent new version of Cowork was changed to execute agent tasks in the cloud by default, completely bypassing the local escape path. However, users who choose to continue running agents locally rather than in the cloud are still at risk - unless they actively disable non-privileged user namespaces, limit file system sharing, and use strict mounting protections to strengthen system configurations.
This incident once again brings the issue of local execution security of AI agents to the forefront. When AI tools gain the ability to read local files, their security boundary depends not only on the reliability of the AI itself but also on whether the underlying virtual machine isolation mechanism is strong enough. As AI agents accelerate their penetration into personal desktops, the trust boundary between user permissions and AI capabilities has become a key issue that the entire industry must re-examine.
