Affected Systems
Anthropic Claude Cowork macOS desktop app running local sessions. Approximately 500,000 macOS users affected prior to mitigation. Users who continue to run local execution (non-cloud) remain vulnerable. Cloud execution mode (now default) is not affected.
Exploitation Status
Proof-of-concept demonstrated by Accomplish AI researchers. Exploit chain uses CVE-2026-46331 (pedit COW) in guest Linux kernel to escalate to guest-root, then accesses host filesystem mounted at /mnt/.virtiofs-root with read-write privileges. No evidence of active exploitation in the wild reported.
Business Impact
AI agent running in Claude Cowork can escape Linux VM sandbox and access entire macOS host filesystem with logged-in user privileges. Attacker or malicious agent can read/write SSH keys, cloud credentials, browser data, and any files accessible to the desktop user. Anthropic closed disclosure as informative without issuing fix for local execution mode; latest version defaults to cloud execution which mitigates the issue, but local mode remains exploitable.
Urgency
🟡 Within a week
Recommended Actions
- Verify Claude Cowork is configured to use cloud execution mode (default in latest version) rather than local VM execution
- If local execution is required, update to latest Claude Cowork version and monitor Anthropic security advisories for patches addressing local mode sandbox escape
- Audit macOS systems running Claude Cowork for unauthorized file access in user directories, particularly SSH keys (~/.ssh/), cloud provider credentials (~/.aws/, ~/.config/gcloud/), and browser profile data
- Implement host-based monitoring for unexpected file access patterns from virtualization framework processes (com.apple.Virtualization) on macOS endpoints
- Consider restricting Claude Cowork usage to non-privileged accounts with limited access to sensitive credentials until local execution sandbox is hardened