Loading story…
Researchers disclosed SharedRoot, a sandbox escape in Anthropic's Claude Cowork for macOS that could let a locally running AI agent break out of its Linux virtual machine and read or modify files on the host Mac. According to the report, the issue affected roughly 500,000 macOS users running local Cowork sessions before mitigations, and the attack chain relied on CVE-2026-46331 ("pedit COW") to escalate privileges inside the guest until the agent gained guest-root access.
The breakout was possible because the host filesystem was reportedly mounted read-write into the guest VM, allowing guest-root to pivot into host files with the permissions of the logged-in desktop user. The underlying mechanics align with Linux capability and namespace behavior that can expand what privileged processes inside a guest can access, while Apple virtualization features enabled the local VM model used by Cowork. Anthropic reportedly classified the finding as informative rather than issuing a direct patch, and newer Cowork releases now default to cloud execution, leaving users who still run local sessions exposed unless stronger architectural isolation is added.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
According to the report, newer Claude Cowork versions default to cloud execution rather than local execution, which avoids the local VM-to-host exposure. The article says Anthropic treated the report as informative and did not issue a direct fix for users who continue to run Cowork locally.
Researchers disclosed a sandbox escape vulnerability, codenamed SharedRoot, affecting Anthropic's Claude Cowork for macOS. The flaw could let a locally running agent escape its Linux VM and read or write files on the host Mac by chaining guest-root access with a host filesystem mount issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourceman7.org
Open sourcedeveloper.apple.com
Open sourceubuntu.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **SharedRoot**, a sandbox escape affecting Anthropic’s Claude Cowork local execution environment on macOS. The attack chain lets an AI agent running inside a Linux virtual machine exploit Linux kernel privilege-escalation bug `CVE-2026-46331` ("pedit COW") to gain root in the guest, then reach writable files on the macOS host through a VirtioFS mount that exposed host storage inside the VM. Researchers described the issue as an **architectural isolation failure**, not a direct compromise of Apple’s Virtualization Framework or macOS hypervisor protections. Accomplish AI said roughly **500,000 macOS users** running local Claude Cowork sessions were potentially affected before Anthropic switched to **cloud execution by default**. The disclosure warned that users who continue to run local execution may still be exposed because guest root can access host-user files through the shared mount. Recommended mitigations include limiting mounts to explicitly shared directories, using read-only mounts where possible, reducing guest kernel and namespace attack surface, and further isolating the `coworkd` daemon.
Jul 25, 2026
Microsoft disclosed **CVE-2022-26706**, a macOS App Sandbox escape that allowed specially crafted code to bypass sandbox restrictions and execute unrestricted commands on a host. The flaw was uncovered during research into malicious macro execution in Microsoft Office on macOS, where Word’s ability to read or write files with the `~$` prefix could be chained with macOS **Launch Services** and the `open --stdin` option to launch a crafted Python file outside the sandbox. Microsoft reported the issue to Apple in October 2021, and Apple addressed it in security updates released in May 2022. The vulnerability is significant because Launch Services and related macOS startup mechanisms have repeatedly appeared in real-world malware tradecraft. MITRE ATT&CK documents **LaunchAgent** persistence under `T1543.001`, noting widespread abuse of plist files in locations such as `~/Library/LaunchAgents` and `/Library/LaunchAgents` by malware including **Bundlore, FruitFly, Proton, ThiefQuest,** and **CookieMiner**. Microsoft said its Defender for Endpoint detections remained effective against multiple Launch Services-based sandbox escape variants, underscoring the defensive value of monitoring for suspicious LaunchAgent creation and unexpected child-process execution from sandboxed applications.
Aug 15, 2026
Researchers reported that Apple’s fix for `CVE-2021-30724` in the root-privileged `CVMServer` daemon introduced a new flaw, tracked as `CVE-2022-26721`, that could be reached from the Safari renderer sandbox on macOS. The bug stemmed from uninitialized cleanup metadata left behind when a bounds check aborted processing, creating a path for attacker-controlled `munmap` operations on arbitrary memory pages inside the service. Theori showed the issue could be turned into root code execution by shaping heap contents, using a binary-search-style oracle to infer `CVMServer` memory layout, and overwriting `dyld` private-memory function pointers. A proof of concept reportedly read `/var/db/SystemKey`, which can be used to decrypt macOS keychain files, underscoring the impact of the sandbox escape and privilege-escalation chain. Apple addressed the vulnerability in macOS 12.4 by replacing `malloc` with `calloc` to ensure the descriptor buffer was zero-initialized.
Jul 24, 2026