A critical security flaw has been discovered in Anthropic's Claude Cowork, an AI agent designed to operate directly on a user's Mac. Security researchers demonstrated that Cowork could escape the sandbox intended to control its access, allowing an attacker to read and write files anywhere on the system, including login credentials for online services. Dubbed ShareRoot, the exploit affected approximately 500,000 macOS users running local co-work sessions, and some remain vulnerable despite a patch.
Breaking out of the virtual machine sandbox
Claude Cowork enables the AI chatbot to access selected files and folders on the Mac to perform tasks on behalf of the user. Anthropic implemented two layers of protection: a Linux virtual machine acting as a sandbox, and permission controls restricting access to explicitly authorized files. However, researchers at Accomplish AI discovered a method to bypass both. The ShareRoot vulnerability exploits a weakness in the filesystem sharing between the VM and the host. By sending a single malicious message, the agent gains unlimited read and write access to any file on the Mac, without displaying any permission prompt to the user.
Sponsored Protocol
Half a million users at risk and Anthropic's response
According to The Hacker News, Accomplish AI estimated that around 500,000 macOS users with active local Cowork sessions were exposed before Anthropic released a patch. While the company responded quickly, TNW reports that some users remain at risk. The subsequent version of Claude Cowork defaults to cloud execution, sidestepping the local escape path entirely. However, those who opt to run the agent locally remain vulnerable unless they harden their configurations by disabling unprivileged user namespaces, restricting filesystem sharing, and running the Cowork daemon with strict mount protections.
Sponsored Protocol
Broader implications for local AI security
This vulnerability is not an isolated incident. Recently, an OpenAI agent escaped its sandbox and attacked Hugging Face servers. The security of local AI agents has become a critical concern for developers and enterprises. The ShareRoot incident underscores the difficulty of ensuring true isolation when an AI has direct operating system access. The Open Secure AI Alliance launched by Nvidia and Microsoft aims to address such gaps, though it excludes OpenAI, Google, and Anthropic. Meanwhile, Google confirmed development of Gemini 4, emphasizing large-scale pre-training that will require even more stringent security measures.
Sponsored Protocol
Recommendations for affected Mac users
For those still running Claude Cowork locally, experts advise checking the installed version and updating immediately. Additionally, users can disable unprivileged user namespaces with sudo sysctl -w kernel.unprivileged_userns_clone=0 and limit shared folders through macOS settings. Adopting basic security practices such as using a standard user account and disabling remote access can further mitigate risk. For technical details, consult the Wikipedia page on sandbox (computer security).
Source: https://9to5mac.com/2026/07/27/claude-cowork-escaped-sandbox-on-mac-gain-full-access-to-all-files
