"When the Sandbox Springs a Leak: What Claude Cowork's SharedRoot Escape Teaches Us About AI Agent Security"

Security researchers at Accomplish AI disclosed a sandbox escape this week that should give anyone running AI agents locally serious pause. Dubbed "SharedRoot," the vulnerability chain allowed Anthropic's Claude Cowork — the desktop agent that operates inside a Linux VM on macOS — to break out of its virtualized confinement and read or write files anywhere on the host Mac. SSH keys, cloud credentials, browser data: all of it was reachable. Estimated exposure: roughly 500,000 macOS users who ran local Cowork sessions before the fix was deployed.

The technical chain, uncovered by researcher Oren Yomtov, is a masterclass in how layered defenses can stack up to less than the sum of their parts. Claude Cowork sessions ran as unprivileged users inside a Linux VM, guarded by a seccomp filter and a broker daemon called coworkd. The entire host filesystem was mounted inside the VM at a path only visible to guest-root — and reaching guest-root turned out to be much easier than intended. Step one: call unshare to enter a new user namespace and become root within it. Step two: leverage CAPNETADMIN to configure a traffic-control action that triggered loading of the act_pedit kernel module. Step three: exploit CVE-2026-46331, a page-cache poisoning bug in that module, to corrupt a root-owned helper binary that coworkd later re-executed. At that point, guest-root was achieved, and the host mount was wide open.

What makes the chain elegant in a grim way is that it didn't modify any on-disk bytes. The page-cache poisoning gave the attacker a write primitive against files they could only read, leaving no forensic trace on the filesystem. Even the NoNewPrivs protections built into the session were useless — coworkd already ran as root when it re-executed the poisoned binary, so there were no new privileges to block. Every layer held individually, but the seams between them gave way.

Anthropic's response is worth examining. The company shifted Cowork to default cloud execution, meaning the local escape path no longer applies to most current sessions. They closed the disclosure as "Informative" rather than as a standalone critical vulnerability, reasoning that the underlying kernel bug fell within their program's 30-day disclosure window and that hardening suggestions amounted to defense-in-depth, not fixes for discrete flaws. From a strict vulnerability management perspective, that's defensible — you ship a patch for the CVE, and the exploit chain collapses.

But Yomtov's pushback gets at something deeper. He argued that relying on upstream kernel patches leaves users "structurally one bug behind," especially as AI-assisted vulnerability research accelerates the pace of kernel privilege-escalation discoveries. This isn't a Claude Cowork problem — it's an industry-wide tension. Every AI agent that runs locally inside a VM or container is betting that the isolation layer it chose is clean. When a new kernel bug drops — and they drop regularly — every agent sandbox on every desktop becomes retrospectively vulnerable until the patch propagates. That's a latency model that doesn't inspire confidence when the assets at risk include SSH keys and cloud credentials.

The mitigation advice from Accomplish AI reads like a checklist the entire industry should be auditing against: disable unprivileged user namespaces, convert seccomp filters from default-allow denylists to strict allowlists, and block autoloading of unused kernel modules. None of these are novel, but the fact that a flagship AI agent product from a leading lab shipped without them suggests how much low-hanging hardening is still out there. The gap between "sandboxed" and "secure" is bigger than most product pages let on.

One underappreciated angle here is the architectural tension between agent capability and sandbox restrictiveness. The more an agent can do — open files, make network connections, execute binaries — the more useful it is, and the more attack surface the sandbox has to expose. Cowork needed enough privilege to be a competent coding agent, which meant the seccomp filter had to permit system calls like unshare and the network stack had to be functional enough to allow CAPNETADMIN to exist. Security researchers and product teams are pulling in opposite directions, and the middle ground is where vulnerabilities like SharedRoot are born.

If there's a silver lining, it's that this disclosure arrived from researchers who reported it responsibly, against a product from a company that moved quickly once they understood the scope. The structural argument — that we're always one kernel CVE away from the next escape — isn't a reason to abandon local agent sandboxes, but it is a strong argument for defense-in-depth that assumes the kernel will eventually be compromised. Agent security can't just be about the isolation layer; it has to be about what happens when that layer inevitably cracks. On that front, SharedRoot is less a failure and more a preview of fights to come.

Further reading

• Accomplish AI's full SharedRoot disclosure — detailed chain breakdown and mitigations
• CVE-2026-46331 details — the underlying kernel vulnerability in the act_pedit module
• Anthropic's Claude Cowork documentation — current architecture and sandboxing approach