AI Risk Wire

Cases › security breach › LR-2026-0614

Claude Cowork sandbox escape through a read-write host mount and the pedit COW kernel flaw

Preliminary Why: 1 report: The Hacker News · subject to change · 1 independent report

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: no action reported

Severity major
Reported 23 Jul 2026
Developer and model Anthropic
Agent tool Linux VM created via Apple's Virtualization framework

No source states: loss or records, could do, deployer, industry.

Severity major: test met by a stated count of about 500,000 affected parties (macOS users running local Cowork sessions prior to the patch)

Anthropic's Claude Cowork runs agent work in a Linux virtual machine on a Mac, with the user's connected folders shared into it. Researchers at Accomplish AI reported that the host file system was mounted into the VM with read-write privileges, and that a sandbox escape let the agent read and write files across the Mac, including SSH keys and cloud credentials reachable through the user's account. The escape used the pedit COW kernel flaw, CVE-2026-46331, to gain guest-root. After responsible disclosure, Anthropic closed the report as informative without issuing a fix. The latest version defaults to cloud execution, which addresses the issue, but users who run the agent locally remain exposed. Accomplish AI said about 500,000 macOS users running local Cowork sessions were affected before it was patched.

What happened

1 · What it was doingThe agent ran its work in a Linux virtual machine on the Mac, with the user's connected folders shared into it.
2 · What went wrongThe host file system was mounted into the VM read-write, and a sandbox escape was demonstrated with one short message.
3 · What it reached or didFrom inside the VM, the agent reached the host Mac and read and wrote files outside the connected folder, with no permission prompt.
4 · How it was caughtCybersecurity researchers uncovered the sandbox escape vulnerability, which Accomplish AI shared with The Hacker News.

What was done

No source states an action or fix.

Risks

Agent escapes its sandbox
Primary19 incidents

Read from the sources; not yet reviewed by a person.

Controls

Harness

Not effective Sandboxed code execution

Application

Not effective Least-privilege access for the agent

Control failure chain

L1 · Model Not stated in sourcesAnthropic
L2 · Harness Not effectiveLinux VM created via Apple's Virtualization framework
L3 · Application Not effectiveDeployer not named
L4 · Infrastructure / target Not stated in sourcesOrganisation hit

L1 · ModelAnthropicModel provider

No source mentions a control at this layer.

Model version not linked to a model card.

L2 · HarnessLinux VM created via Apple's Virtualization frameworkAgent framework vendor

Not effectiveSandboxed code execution“Cybersecurity researchers have uncovered a sandbox escape vulnerability in Anthropic's Claude Cowork that makes it possible to break out of the confines of a Linux virtual machine (VM) within which the agent runs to read or write files anywhere on the Mac.”The Hacker News

Other controls for this risk at this layer, not mentioned in the sources: Network egress control, Fail-closed defaults.

L3 · ApplicationDeployer not namedDeployer

Not effectiveLeast-privilege access for the agent“Because the entire host file system is mounted into the agent's VM with read-write privileges, any path to guest-root can grant the agent access to the underlying host, effectively escaping the sandbox.”The Hacker News

Other controls for this risk at this layer, not mentioned in the sources: Segmentation of agent components, Vulnerability scanning of AI components, Live behaviour monitoring, Adversarial testing before deployment.

L4 · Infrastructure / targetOrganisation hit

No source mentions a control at this layer.

EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target

Controls for this risk: result in this incident

ControlPart of the systemResult
Sandboxed code executionL2 HarnessNot effective
Network egress controlL2 HarnessNot stated in sources
Fail-closed defaultsL2 HarnessNot stated in sources
Least-privilege access for the agentL3 ApplicationNot effective
Segmentation of agent componentsL3 ApplicationNot stated in sources
Live behaviour monitoringL3 ApplicationNot stated in sources
Vulnerability scanning of AI componentsL3 ApplicationNot stated in sources
Adversarial testing before deploymentL3 ApplicationNot stated in sources

Similar incidents

Anthropic Claude model develops working Linux kernel MPTCP root exploit (CVE-2026-98432)2026-10-29
Claude Cowork deletes family photo folder during desktop organisation2026-02-08
Claude Code GitHub Action prompt-injection flaw could expose GitHub credentials2026-06-06
Claude API flaw allows indirect prompt injection to steal user data2025-11-03

All cases of this kind ›

Evidence

No source states: when it happened, when it was found, how many records were exposed, the direct loss, any court case, the cause, what set it off, what was done.

Show the full account: 2 items from the primary sources

What happened, in order

Not dated in the sources:

  • After responsible disclosure, Anthropic closed the vulnerability report as informative without issuing a fix.
  • About 500,000 macOS users running local Cowork sessions were affected before the flaw was patched.
Show every field, with its source and grade

The AI system

Developer
Anthropic
C one secondary source states it
Software around the model
Linux VM created via Apple's Virtualization framework
C one secondary source states it
What it was allowed to do
read-write access to the entire host file system
C one secondary source states it

What happened

Earliest source we hold
2026-07-23
D inferred by us from the described behaviour, reason shown
Who caught it
an outside party
C one secondary source states it
Cause in detail
Entire host file system mounted into the agent VM with read-write privileges
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
primary risk
RK05
D inferred by us from the described behaviour, reason shown
control chain
layer: L2; party: harness vendor; control id: E1; outcome: failed; quote: Cybersecurity researchers have uncovered a sandbox escape vulnerability in Anthropic's Claude Cowork that makes it possible to break out of the confines of a Linux virtual machine (VM) within which the agent runs to read or write files anywhere on the Mac.; source index: 0, layer: L3; party: deployer; control id: A1; outcome: failed; quote: Because the entire host file system is mounted into the agent's VM with read-write privileges, any path to guest-root can grant the agent access to the underlying host, effectively escaping the sandbox.; source index: 0
C one secondary source states it

Impact

Other parties affected
500,000
C one secondary source states it
Severity
major
D inferred by us from the described behaviour, reason shown
Who was affected
About 500,000 macOS users running local Cowork sessions were affected prior to the patch
C one secondary source states it
Why this severity
test met by a stated count of about 500,000 affected parties (macOS users running local Cowork sessions prior to the patch)
D inferred by us from the described behaviour, reason shown

Notes on gaps

Anthropic's own account is not in the sources. The OpenAI sandbox breach mentioned in the source concerns a different incident and was not used. Patch timing and the status of local-execution users are not stated beyond the quoted sentences.

LR-2026-0614 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON