Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files

Researchers discovered a sandbox escape vulnerability in Anthropic's Claude Cowork that allows an AI agent running in a Linux VM (virtual machine, an isolated computing environment) to break out and access files anywhere on a Mac computer. The flaw, called SharedRoot, affected about 500,000 macOS users and works because the entire Mac file system is mounted into the agent's VM with read-write access, allowing the agent to exploit a Linux kernel bug to gain elevated privileges and steal sensitive data like SSH keys and passwords.