SharedRoot: Claude Cowork Sandbox Escape Explained

The sandbox that is supposed to keep an AI agent boxed away from your machine can, under the right conditions, be walked straight out of. Security researchers at Accomplish AI disclosed an attack chain they call SharedRoot that lets untrusted content inside a Claude Cowork session escape its Linux virtual machine and reach the host macOS filesystem — including the user’s SSH keys and cloud credentials. The demonstration is unnervingly simple: connect a folder to a fresh session, send a single message, and watch the agent read and write files across the Mac.

Cowork is Anthropic’s agentic workspace, in which the AI agent runs tasks on the user’s behalf inside a sandbox. The whole security model depends on that sandbox holding. SharedRoot is a case study in how a stack of individually reasonable design choices can combine into a full escape.

From one message to host access

The researchers’ setup mirrors ordinary use: a user attaches a working folder to a new Cowork session so the agent can operate on it. In the proof of concept, a single crafted message is enough to set the chain in motion — the agent, acting on untrusted input, executes the steps that break containment. It is the agentic analogue of a classic injection: content the model is asked to process becomes the trigger for actions the user never intended, a failure mode closely related to prompt injection.

Once triggered, the agent does not stay inside its Linux VM. It obtains elevated privileges within the guest, then follows a mount out to the host, where it can reach whatever the logged-in Mac user can reach. In Accomplish’s write-up, that meant browsing and modifying files well outside the connected folder — the kind of access that turns a contained assistant into a foothold on the whole machine.

The four links in the chain

SharedRoot is not a single bug so much as a compounding of design decisions. The researchers trace it to four choices about how the sandbox, the kernel, and the host filesystem were wired together:

1. The whole host filesystem is mounted into the VM. The guest reaches the host through a virtiofs mount that exposes the entire host filesystem, not just the folder the user connected. That means the destination for an escape — the user’s home directory, keys, and credentials — is already present inside the VM’s view; an attacker only needs enough privilege to read it.

2. Unprivileged user namespaces are available in the guest. Linux user namespaces let an unprivileged process gain capabilities inside a namespace it controls. Left enabled in the guest, they hand an attacker the primitive needed to load kernel functionality that would otherwise be off-limits.

3. A known kernel flaw provides guest-root. The chain abuses CVE-2026-46331, nicknamed “pedit COW” — a publicly documented Ubuntu kernel vulnerability that lets an attacker corrupt the page cache of files they can read but not modify. The exploit loads the kernel’s act_pedit traffic-control subsystem into an unprivileged user namespace and uses the flaw to escalate to root inside the guest.

4. Guest-root plus a full host mount equals host access. With root in the VM and the entire host filesystem already mounted via virtiofs, the final step is short: the agent walks out through the mount and operates on the host as the logged-in Mac user — reading SSH keys, cloud credential files, and anything else that user can touch.

None of these is exotic on its own. The danger is the combination: a shared root, a reusable kernel primitive, and a mount that treats the host as fair game.

Scope and Anthropic’s response

Accomplish estimated that roughly 500,000 macOS users running local Cowork sessions were exposed before the escape path was closed off. Crucially, the exposure was tied to local execution — sessions running the sandbox on the user’s own Mac.

According to the researchers, Anthropic closed the report as “informative” without issuing a code fix for the chain as reported. What changed the practical risk is a shift in defaults: the latest version of Cowork defaults to cloud execution, which sidesteps the local escape path entirely by not running the vulnerable sandbox-on-the-host configuration in the first place. In other words, the mitigation is architectural — move the sandbox off the machine that holds the credentials — rather than a patch to any single one of the four links.

That distinction matters for users. If a session never runs the sandbox on the same host that stores your keys, an escape has nowhere valuable to land. Users who still run local sessions, or older builds, do not get that protection automatically.

What it means

SharedRoot is less a story about one exotic exploit than about the security assumptions underneath agentic AI. The entire value proposition of a tool like Cowork is that you can hand an agent a task and untrusted material — a repo, a folder, a document — and let it work. But “untrusted material processed by a capable agent inside a sandbox with a view of your whole disk” is exactly the recipe SharedRoot weaponizes. The lesson generalizes well beyond one product: as agents gain the ability to run code, the boundary between the sandbox and the host becomes the security boundary that matters most.

The defenders’ takeaway is that isolation has to be designed as if the agent is already compromised, because untrusted input can make it behave that way. Mounting only the folder a user connected — rather than the whole filesystem — disabling unprivileged user namespaces in the guest, and keeping the guest kernel patched against known local-privilege-escalation bugs like act_pedit would each have broken the chain. Defense in depth means no single failure should reach the host’s secrets.

The move to cloud execution by default is the pragmatic fix, and it points to where agentic tooling is heading: run the risky part somewhere that cannot see your SSH keys. But it also relocates trust rather than eliminating it — cloud sandboxes bring their own isolation and data-handling questions. This is not the first time an AI agent has been shown breaking out of its box, and it echoes earlier work on model sandbox escapes; expect this class of finding to keep surfacing as red-teaming catches up with how much autonomy these systems now have.

What to watch next: whether Anthropic hardens the local sandbox for users who still need on-device execution; whether other agentic platforms that mount host filesystems get the same scrutiny; and whether “the agent can be turned against its host” becomes a standard threat model — the way zero-day disclosure reshaped how software vendors think about patch timelines. The agents are getting more capable fast. Their sandboxes need to keep pace.