SharedRoot: Claude Cowork’s AI Agent Can Escape Its VM and Read Your Files

A connected folder, a fresh session, and a short message: that's all it takes to make Claude Cowork break out of the virtual machine meant to contain it, so it can read and write files all over the host without asking for permission. Dubbed SharedRoot, this attack chain was reported to Anthropic. Here's what we know.

Full Host Disk Sharing Is a Painful Detail

Claude Cowork is Anthropic's tool designed to automate office tasks. On macOS, the app runs under the logged-in user's account, but the agent's work happens elsewhere: in a Linux virtual machine created through Apple’s Virtualization framework. Each session gets its own disposable, unprivileged user, protected by a seccomp filter. The folders you connect are mounted inside the VM by a daemon running as root and named coworkd. On paper, that means what the agent does stays inside the VM and the folders you entrusted to it.

But that isolation was called into question on macOS systems by Oren Yomtov, a security researcher at Accomplish AI.

He spotted a detail that changes everything: the entire host file system, meaning the Mac's root /, would be mounted read-write inside the VM at /mnt/.virtiofs-root, and visible only to the root user of the guest system. In other words, the whole workstation is already present inside the sandbox, with the agent's privileges as the only barrier.

According to the report published by Accomplish AI, exploiting this vulnerability takes 6 steps:

• Starting point : the agent runs as an unprivileged session user, with no vulnerability exploited at this stage.
• Gaining capabilities : because unprivileged user namespaces are allowed in the guest, the session can create one and obtain CAP_NET_ADMIN. This is not an exploit, but a still-enabled kernel feature. This name often comes up in security issues related to the Linux kernel.
• Access to vulnerable code: this capability makes it possible to configure a traffic control action that triggers automatic loading of the act_pedit module.
• Write primitive: on this kernel, act_pedit is vulnerable to CVE-2026-46331, also known as pedit COW. It allows a file that can only be read to be poisoned in memory, without modifying anything on disk.
• Privilege escalation as root: coworkd, which runs as root, re-executes the poisoned binary. The NoNewPrivs safeguard is bypassed because the calling process is already root.
• VM escape: root can see /mnt/.virtiofs-root, meaning the whole host, and can read and write there with the desktop user's rights.

"We connected a folder to a fresh Claude Cowork session, sent a short message, and watched the agent escape the sandbox.", explains Oren Yomtov, who specifies that the chain was executed end to end on a machine. What makes this dangerous is that everything becomes accessible through Claude Cowork, including sensitive data (SSH keys, credentials, and so on).

This scenario therefore relies on exploiting CVE-2026-4633, disclosed on June 16, 2026. It is an out-of-bounds write in the act_pedit action of the net/sched subsystem, which corrupts the shared page cache. The day after disclosure, researcher Massimiliano Oldani had already published an exploit for this flaw, which carries a CVSS 3.1 score of 7.8 out of 10.

What Is Anthropic's Take?

This security issue directly concerns Anthropic, the publisher of Claude Cowork. That's where things get complicated. Accomplish AI says it reported the attack chain to Anthropic, which closed the report as "Informative." Accomplish AI cites two reasons:

• The security flaw fell within the exclusion window for the program, which covers vulnerabilities published in the last thirty days,
• The hardening recommendations were considered defense in depth rather than standalone vulnerabilities.

Accomplish AI considers this decision defensible for a bug bounty program, but says it says nothing about the real exposure of a workstation. From the user's perspective, relying on kernel fixes released upstream amounts to making the sandbox's resilience depend on a patch race they are not running and cannot win.

The researchers also explain that Claude Cowork now uses cloud execution by default, and that this local escape path does not appear to apply there. That may also be what led Anthropic to dismiss the vulnerability.

It is also worth noting that, in its May 25, 2026 article, Anthropic explains that Cowork's VM has access only to the selected working folder and the .claude folder (they are mounted), and that nothing else on the host is visible. Even if Accomplish AI's demo does not contradict that statement, since the full host mount is visible only to root inside the guest, it is still shaky: the resource is there, and a local privilege escalation is all it takes to reach it.

So what should you do to protect yourself from this security issue?

Accomplish AI reduces the answer to four architecture decisions, each of which would be enough on its own to break the chain:

• Reject unprivileged user namespaces,
• Harden the seccomp filter, which is currently considered too permissive,
• Prevent unnecessary kernel modules from auto-loading,
• Above all, mount only the folders that are actually connected inside the VM, rather than the entire host.

That last point is probably the most important, because it is what makes access to the workstation possible in the first place.

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio