Claude Cowork sandbox escape: where your agent runs matters

A Claude Cowork sandbox escape published this week walks from "agent processes untrusted content" to "agent reads your SSH private keys." Accomplish researcher Oren Yomtov named the chain SharedRoot, and the interesting part isn't the kernel bug in the middle. It's the architecture on either side of it — and the fact that the setting deciding your exposure is one most teams never thought about: where the agent actually runs.

What actually happened

Per Accomplish's write-up, Cowork's local mode ran agent sessions in a Linux VM on the Mac. The chain: the session user calls unshare to get root inside a new user namespace, uses CAP_NET_ADMIN to configure a traffic-control action against the vulnerable act_pedit module over netlink, and exploits CVE-2026-46331 — a copy-on-write bug — to poison the page cache of a root-owned helper binary. When coworkd re-executes that binary, the attacker has guest root.

Then the payoff. Guest root reaches /mnt/.virtiofs-root — the entire host filesystem, mounted read-write. The researchers confirmed the full chain by writing a file into the host user's home directory, well outside the folder connected to the Claude session. SSH keys, cloud credentials, anything the logged-in user can read.

Anthropic closed the report as "Informative" — the CVE fell inside the program's window for bugs published in the last 30 days, and the hardening items were read as defense-in-depth rather than standalone vulnerabilities. The Hacker News and SC Media both covered it. The practical mitigation is already shipped: Cowork now defaults to cloud execution, and this local escape path doesn't appear to apply there.

Why it matters for your business

Accomplish's own framing is the right one: the kernel CVE is replaceable. Unprivileged user namespaces, permissive seccomp rules, autoloadable kernel modules, and a whole-host filesystem share mounted read-write — leave those four in place and the next Linux privilege-escalation bug rebuilds the same chain. The sandbox wasn't defeated by a clever exploit. It was configured to be defeatable.

For a small team, the takeaway is one decision you can make today. When an AI agent tool offers local or cloud execution, that's not a latency preference — it's a blast-radius choice. Local means the agent shares a machine with your SSH keys, your ~/.aws credentials, your password manager's local store. Cloud means a compromised session gets whatever you explicitly connected and nothing else. If you keep a tool in local mode, the machine it runs on should not be the machine holding production credentials.

This is the same pattern as Cursor's DuneSlide RCE: give an agent broad local reach for convenience, and prompt injection becomes a credential-theft vector. Scope what the agent can see before you scope what it can do.

Sources: Accomplish — SharedRoot, The Hacker News, SC Media.