Loading story…
Researchers disclosed SharedRoot, a sandbox escape affecting Anthropic’s Claude Cowork local execution environment on macOS. The attack chain lets an AI agent running inside a Linux virtual machine exploit Linux kernel privilege-escalation bug CVE-2026-46331 ("pedit COW") to gain root in the guest, then reach writable files on the macOS host through a VirtioFS mount that exposed host storage inside the VM. Researchers described the issue as an architectural isolation failure, not a direct compromise of Apple’s Virtualization Framework or macOS hypervisor protections.
Accomplish AI said roughly 500,000 macOS users running local Claude Cowork sessions were potentially affected before Anthropic switched to cloud execution by default. The disclosure warned that users who continue to run local execution may still be exposed because guest root can access host-user files through the shared mount. Recommended mitigations include limiting mounts to explicitly shared directories, using read-only mounts where possible, reducing guest kernel and namespace attack surface, and further isolating the coworkd daemon.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
Before the disclosure, Anthropic changed Claude Cowork so cloud execution became the default, reducing exposure from the local execution design. Researchers said about 500,000 macOS users running local Claude Cowork sessions had potentially been affected before this change, while users who continue local execution remain exposed.
Researchers disclosed a sandbox escape dubbed SharedRoot affecting Anthropic's Claude Cowork local execution environment on macOS. The issue let an AI agent gain root inside the Linux guest via CVE-2026-46331 and then access writable host files through a VirtioFS mount, which researchers described as an architectural isolation failure rather than a hypervisor escape.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
5 references tracked. Mallory keeps watching after this page renders.
socradar.io
Open sourcecybersecuritynews.com
Open sourcereddit.com
Open sourcethecybersecguru.com
Open sourceaccomplish.ai
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **SharedRoot**, a sandbox escape in Anthropic's Claude Cowork for macOS that could let a locally running AI agent break out of its Linux virtual machine and read or modify files on the host Mac. According to the report, the issue affected roughly **500,000** macOS users running local Cowork sessions before mitigations, and the attack chain relied on `CVE-2026-46331` ("pedit COW") to escalate privileges inside the guest until the agent gained guest-root access. The breakout was possible because the host filesystem was reportedly mounted **read-write** into the guest VM, allowing guest-root to pivot into host files with the permissions of the logged-in desktop user. The underlying mechanics align with Linux capability and namespace behavior that can expand what privileged processes inside a guest can access, while Apple virtualization features enabled the local VM model used by Cowork. Anthropic reportedly classified the finding as informative rather than issuing a direct patch, and newer Cowork releases now default to **cloud execution**, leaving users who still run local sessions exposed unless stronger architectural isolation is added.
Jul 23, 2026
Apple fixed **CVE-2026-20685**, a path traversal flaw in its Private Cloud Compute (PCC) environment that could allow an attacker to write files as root during node boot and redirect sensitive AI inference telemetry to an external server. The vulnerability was found in `darwin-init`, a root-privileged early boot component that extracted attacker-controlled archives without properly blocking traversal sequences, enabling writes outside the intended directory and onto PCC's writable data volume. Apple rated the issue as information disclosure with a CVSS score of **6.5** and addressed it in PCC releases **5E290.3 and later**. Research showed a crafted archive could persist across boot and modify PCC logging behavior through `splunkloggingd` configuration, exposing metadata tied to Apple Intelligence inference requests inside Apple's Virtual Research Environment. The work, published through Sentry's AI security research effort, also highlighted an attestation gap because files on the writable data volume that could influence runtime daemon behavior were not included in PCC attestation measurements. Sentry researcher **Drinor** reported the flaw and received a **$150,000** Apple Security Bounty.
Aug 11, 2026
Microsoft disclosed **CVE-2022-26706**, a macOS App Sandbox escape that allowed specially crafted code to bypass sandbox restrictions and execute unrestricted commands on a host. The flaw was uncovered during research into malicious macro execution in Microsoft Office on macOS, where Word’s ability to read or write files with the `~$` prefix could be chained with macOS **Launch Services** and the `open --stdin` option to launch a crafted Python file outside the sandbox. Microsoft reported the issue to Apple in October 2021, and Apple addressed it in security updates released in May 2022. The vulnerability is significant because Launch Services and related macOS startup mechanisms have repeatedly appeared in real-world malware tradecraft. MITRE ATT&CK documents **LaunchAgent** persistence under `T1543.001`, noting widespread abuse of plist files in locations such as `~/Library/LaunchAgents` and `/Library/LaunchAgents` by malware including **Bundlore, FruitFly, Proton, ThiefQuest,** and **CookieMiner**. Microsoft said its Defender for Endpoint detections remained effective against multiple Launch Services-based sandbox escape variants, underscoring the defensive value of monitoring for suspicious LaunchAgent creation and unexpected child-process execution from sandboxed applications.
Aug 15, 2026