Critical Claude Cowork Sandbox Escape Flaw Exposes SSH Keys, Cloud Credentials

Key Takeaways

• A critical vulnerability named “SharedRoot” has been discovered in Claude Cowork’s local sandbox environment.
• This flaw allows a malicious AI agent to escape its Linux virtual machine (VM) and gain full access to the host macOS filesystem.
• Sensitive data, including SSH private keys and cloud credentials, can be exfiltrated or modified without user interaction.
• The vulnerability is a chain of four design weaknesses and an Ubuntu kernel flaw (CVE‑2026‑46331).
• The incident severely compromises the security assurances of Cowork’s local execution model.

A severe security vulnerability has been identified in the local sandbox environment of Claude Cowork, enabling an adversarial AI agent to bypass its Linux virtual machine and gain unauthorized access to the host macOS filesystem. This critical flaw permits the exfiltration of sensitive information, such as SSH private keys and cloud credentials, without requiring any user prompts or interaction.

The root cause of this issue is not a singular kernel vulnerability but rather a combination of four questionable design decisions related to the integration of the sandbox, kernel features, and the host filesystem. This multi-faceted exploit chain has been dubbed “SharedRoot” by security researchers.

SharedRoot: Escaping the Cowork Sandbox

Researchers from Accomplish successfully executed the “SharedRoot” attack, demonstrating how untrusted content within a Claude Cowork session can escape its VM and directly interact with the host macOS filesystem. By initiating a new Cowork session with a shared folder and leveraging a specially crafted prompt, they proved the ability to read and write files across the host user’s entire account, far exceeding the intended boundaries of the shared folder.

Cowork is designed to execute AI-driven code within a Linux VM as an unprivileged user, employing seccomp filters and brokered mounts to manage untrusted workloads. The expectation is that all actions performed by the AI agent remain strictly confined to the guest VM and explicitly selected folders. However, the SharedRoot exploit reveals a significant breach in this boundary, transforming what was presumed to be a secure coding environment into a direct pathway for host compromise.

The macOS Cowork application operates under the privileges of the logged-in user, launching a Linux VM via Apple’s Virtualization framework. Within this VM, the AI agent is placed into an unprivileged session account protected by a permissive seccomp profile. A critical vulnerability emerges because the entire host filesystem is made accessible within the VM through a virtiofs mount.

Exploitation commences when the session user creates a user namespace using the unshare command. This action effectively grants the user capabilities equivalent to root privileges within that specific namespace. This configuration allows the agent to utilize the act_pedit kernel module via a netlink socket, an action permitted by the lenient seccomp filter, which subsequently triggers the autoloading of a vulnerable kernel module.

The Pedit COW Vulnerability and Privilege Escalation

The central vulnerability underpinning this exploit chain is identified as CVE‑2026‑46331, known as “pedit COW.” This publicly documented Ubuntu kernel flaw enables an attacker to corrupt the page cache of files they can access but do not possess modification rights for. By exploiting this bug, the AI agent targets a root-owned binary, altering its in-memory cached image without affecting its on-disk version, thereby circumventing traditional integrity checks.

The root daemon, coworkd, eventually re-executes the compromised binary during its routine operations. When this occurs, the daemon inherits the malicious modifications while running with full root privileges. Crucially, safeguards such as NoNewPrivs do not mitigate this privilege escalation scenario, as the executing process already possesses complete root access.

Upon achieving root access within the guest VM, the agent can effortlessly access the hidden filesystem mount, which exposes the host’s root directory. This unprecedented access permits navigation through the host user’s home directory, enabling the compromise of SSH keys, cloud credentials, and other sensitive files. Furthermore, the agent gains the ability to create or modify files and configurations on the host without any user consent.

Researchers successfully executed this full exploit chain, demonstrating that a file written inside the supposed “sandbox” appeared in the host user’s home directory almost immediately. This incident severely undermines the fundamental security assurances of Cowork’s local execution model, highlighting that the problem extends beyond a specific kernel flaw to encompass significant design missteps.

What You Should Do

• Review and apply any available patches or updates released by the vendor for Claude Cowork.
• Avoid running untrusted AI agents or code within the Cowork environment until a confirmed fix is in place.
• Regularly back up critical data, including SSH keys and cloud credentials, and store them securely offline.
• Implement multi-factor authentication (MFA) for all cloud services and sensitive accounts to add an extra layer of security.
• Monitor system logs for unusual activity or unauthorized file access, especially within the user’s home directory.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.