Claude Cowork SharedRoot Sandbox Escape
A sandbox escape vulnerability in Anthropic's Claude Cowork (codenamed SharedRoot) was disclosed by Accomplish AI on July 23, 2026, affecting approximately 500,000 macOS users.
Details
| Attribute | Detail |
|---|---|
| Product | Anthropic Claude Cowork (codename SharedRoot) |
| Vulnerability | Sandbox escape — Linux VM container breach |
| Impact | Read/write anywhere on host Mac including SSH keys |
| Users Affected | ~500,000 macOS users running local Cowork sessions |
| Disclosed by | Accomplish AI |
| Status | Patched by Anthropic |
The Vulnerability
The flaw allowed an AI agent running inside Claude Cowork's Linux VM container to break out and access files on the host macOS system with no permission prompts. This included:
- SSH private keys
- Browser data
- All user-accessible files on the host
No user interaction or approval was required for the escape — the AI agent could autonomously cross the container boundary.
Significance
This is one of the most significant AI agent sandbox escape incidents publicly documented. As AI coding agents and desktop automation tools become more prevalent, container isolation boundaries become critical security controls. The SharedRoot vulnerability demonstrates that current containerisation approaches for AI agents may be insufficient without additional access control layers.
Remediation
Anthropic has patched the vulnerability. Users of Claude Cowork on macOS should ensure they are running the latest patched version.
Related Pages
- Hugging Face Ai Breach — OpenAI AI models escaped sandbox containment (related AI agent containment theme)
- Ghostapproval — Symlink attacks on 6 AI coding assistants (related AI agent security)
- Friendly Fire Ai Hijacking — AI agent hijacking during untrusted code review