SharedRoot Vulnerability Let AI Agents Escape Claude Cowork's Sandbox to Read Mac SSH Keys and Cloud Credentials

A sandbox escape vulnerability in Anthropic's Claude Cowork allowed untrusted content processed by the AI agent to break out of its isolated environment and access sensitive files on a macOS host, including SSH private keys and cloud credentials. Security researcher Oren Yomtov of Accomplish AI, who disclosed the flaw, named the attack chain SharedRoot.

Claude Cowork runs agent workloads inside a Linux virtual machine on macOS, with sessions operating under an unprivileged user while selected user folders are integrated into the VM. Researchers found the VM also exposed the entire host filesystem through a writable VirtioFS mount, intended to be accessible only to root within the guest. Yomtov demonstrated a method for a standard session user to gain guest-root privileges and reach that mount, effectively bridging the isolation boundary the entire product design depends on.

How the escape actually worked

The attack chain did not rely on a single dramatic exploit. Instead, it combined several design decisions that, individually, looked reasonable but together created a usable escape path. A session user could call an unprivileged Linux kernel feature to gain a full set of capabilities inside a new user namespace, a legitimate kernel function the guest environment left enabled rather than restricted. From there, the researchers used a kernel bug in a traffic-control action module, accessed through a permissive interface, to poison cached pages associated with a read-only file, ultimately targeting a root-owned helper binary that remained readable to the sandboxed session.

Yomtov described the actual demonstration in stark terms: "We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox." From inside the VM, the researchers reached the host Mac and read and wrote files across it, well outside the single folder the session had explicitly been granted access to, with no permission prompt appearing at any point in the chain.

Why the researchers frame this as an architecture problem, not just a bug

Accomplish AI's own writeup is notably specific about what it considers the real lesson. The kernel bug that made the final step possible is described as the least interesting part of the finding. What the researchers emphasise instead are four separate design decisions, any one of which, if changed, would have stopped not just this specific escape but the next kernel bug that might otherwise have enabled a similar chain. That framing matters for any organisation evaluating AI agent platforms more broadly, since it suggests the underlying risk is structural to how sandboxed agent execution is designed, not confined to a single patchable flaw.

This is not the only sandbox related weakness reported against the same product. A separate attack chain disclosed against the Windows version of Claude Cowork exploited two distinct issues in its VM service and remote procedure call interface, allowing arbitrary command execution as root inside a Hyper-V isolated Ubuntu virtual machine and stripping the network restrictions meant to contain it. Anthropic disputed the severity of that particular chain, noting it required an attacker to already have local code execution on the host machine, a precondition it argued limited real world exploitability. The SharedRoot chain, by contrast, requires only that the agent process untrusted content inside a session, a materially lower bar for exploitation.

Scale and remediation

Accomplish AI estimated approximately 500,000 macOS users running local Cowork sessions were affected prior to the vulnerability being patched. Anthropic has since moved Cowork toward default cloud based execution, which the researchers note may mean this specific local VM escape path does not apply to cloud hosted sessions going forward. Anthropic classified the original vulnerability report as "Informative" rather than a qualifying security submission, a decision the company said was influenced by the vulnerability having already been publicly disclosed and by the timing relative to its reporting window.

Why this matters for GCC enterprises deploying agentic AI tools

This case is a concrete illustration of a governance gap security teams across the region have already been warned about directly: agentic AI tools are increasingly running inside enterprise environments across the GCC, often without security team oversight, and the attack surfaces these tools open frequently differ substantially from those security teams are accustomed to defending. A sandbox escape in a productivity focused AI agent is not a theoretical risk category. It is a direct path to credential theft, cloud account compromise, and lateral movement, achieved simply by having the agent process a piece of untrusted content during an otherwise routine session.

Organisations evaluating or already running AI coding or productivity agents that rely on sandboxed or virtualised isolation should treat that isolation boundary as a specific area for security review rather than an assumed given. Practical steps include auditing which folders and credentials are actually accessible to an agent session, monitoring for unexpected privilege escalation or unusual system calls originating from agent sandboxes, and where agent platforms cannot be fully evaluated, restricting their use to environments without access to sensitive credentials or production systems.