"SharedRoot" Escapes the Claude Cowork Sandbox to Read Host Mac Files (CVE-2026-46331)

Anthropic's Claude Cowork running local sessions on macOS, where the agent executes inside a Linux virtual machine

Untrusted content processed by the agent can break out of the Linux VM and read or write files anywhere on the host Mac, including SSH private keys in `~/.ssh`, AWS credentials in `~/.aws`, cloud CLI tokens, browser data, source repositories, and enterprise configuration files, with no user prompt. Press coverage put roughly 500,000 macOS endpoints in scope for local Cowork sessions before the change in defaults. Anthropic classified the report as "Informative" under its bug bounty program and now runs Cowork with cloud execution by default, which the researcher says the local escape does not apply to; users who deliberately choose local execution remain exposed

A six-step chain that leans on sandbox misconfiguration more than on the kernel bug itself: create an unprivileged user namespace to obtain root-like capabilities, load a vulnerable traffic-control kernel module over a netlink socket, exploit CVE-2026-46331 (incorrect copy-on-write handling in the `act_pedit` packet-editing code) to poison the page cache of a root-owned binary, run that poisoned binary through the `coworkd` daemon to reach guest root, then read and write the host filesystem exposed inside the VM at `/mnt/.virtiofs-root`. Found by Oren Yomtov (Accomplish)