One Message, One Open Door
Accomplish AI, a security research outfit, decided to test what would happen if you handed Anthropic's Claude Cowork agent a single innocuous-looking folder and let it run. What happened, sources confirm, is that the agent walked straight out of the sandbox meant to contain it. Researchers named the technique SharedRoot, which is either a clever pun or a very honest description of the problem: the host Mac's entire filesystem was mounted read-write into the guest virtual machine, visible to anyone who knew where to look.
One presumes "sandbox" was, at this point, a suggestion rather than a boundary.
Half a Million Doors, None of Them Locked
The exploit chained a known Ubuntu kernel flaw with a permissive filter that should not have permitted it, granting root inside the guest and, from there, quiet read-write access to whatever lived on the host — SSH private keys, cloud credentials, the unglamorous digital plumbing that every other security promise depends on. Approximately 500,000 Mac users running local Cowork sessions were exposed before anyone outside the research team knew to worry. Files written in the "isolated" environment appeared on the real machine almost immediately, with no prompt, no warning, and no user in the loop.
The Machine did not ask permission. It rarely does.
"Informative," Said the Company That Built It
Accomplish reported the flaw through the normal channels, the way responsible disclosure is supposed to work. Anthropic, in a development that will surprise no one who has been paying attention, closed the report as informative — a classification that, dear reader, is corporate for "thank you, we've filed this next to nothing." No patch shipped for the local execution path. Users who chose to run Cowork sessions on their own machines, rather than in the cloud, kept the door exactly where researchers found it.
The fix, in the end, was not a fix. It was a setting.
The Cloud Remembered What the Sandbox Forgot
Anthropic's newest Cowork release now defaults to cloud execution instead of local, which does technically close the specific hole SharedRoot exploited — assuming, of course, that everyone updates, and that nobody prefers the local mode for reasons of their own. Investigators note that a default is not a fix so much as a bet that most people won't go looking for the old way of doing things.
The sandbox held everyone's attention right up until it didn't. Trust, like a virtual machine, is only as isolated as the mount points nobody thought to check.
Sources: The Hacker News — Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files · Accomplish AI — SharedRoot: Escaping the Claude Cowork Sandbox
