A significant security vulnerability has been discovered in Anthropic’s Claude Cowork that could allow attackers to escape its virtual machine sandbox and access sensitive credentials on Mac computers. Security researchers at Accomplish AI demonstrated the flaw, raising serious concerns about the safety of AI development tools running on local machines.
What Happened
The attack, dubbed SharedRoot, exploits a Linux kernel privilege escalation vulnerability to break out of Claude Cowork’s sandboxed environment. Once an attacker gains root access inside the guest VM, they can traverse through to the underlying Mac system and read protected files, including SSH keys and cloud credentials stored on the host machine. This represents a complete breakdown of the isolation that sandbox environments are designed to provide.
The research demonstrates that the virtual machine boundary between the containerized Claude Cowork application and the underlying operating system is not as secure as users might expect. By leveraging kernel-level vulnerabilities, attackers can elevate privileges within the VM and then pivot to access the host system’s sensitive data.
Key Points
The implications are severe for developers using Claude Cowork on their personal machines. SSH keys stored in standard locations like ~/.ssh/ would be accessible to attackers exploiting this vulnerability. Similarly, cloud credentials used for AWS, Azure, or other services could be compromised. For developers managing multiple projects or infrastructure, this could lead to widespread system compromise.
Anthropic has not yet issued a public statement regarding the vulnerability or timeline for patches. This is particularly concerning given that developer tools like Claude Cowork are often used in environments where multiple sensitive credentials are stored. The vulnerability underscores a broader challenge in containerized security: even well-intentioned sandboxing mechanisms can have gaps when underlying system vulnerabilities exist.
What This Means
This discovery highlights critical questions about the security architecture of AI development tools. As AI assistants become more integrated into developer workflows, ensuring robust isolation between the AI runtime environment and the host system becomes increasingly important. Users of Claude Cowork should consider rotating any credentials that may have been exposed and avoid using the tool until patches are released.
The research also serves as a reminder that security is not a single-layer problem. Even if an application is containerized or virtualized, vulnerabilities in underlying systems can undermine those protections. Development teams working on AI tools should implement defense-in-depth strategies, regularly audit their sandboxing implementations, and maintain rapid patch deployment processes.
