Affected Systems
Anthropic Claude Cowork macOS desktop app running local sessions. Approximately 500,000 macOS users affected prior to mitigation. Users who continue to run local execution (not cloud) remain vulnerable. Cloud execution mode (now default) is not affected.
Exploitation Status
Proof-of-concept demonstrated by Accomplish AI researchers. Exploit chain uses CVE-2026-46331 (pedit COW) in guest Linux kernel to escalate to guest-root, then accesses host filesystem mounted at /mnt/.virtiofs-root with read-write privileges. No evidence of active exploitation in the wild reported.
Business Impact
AI agent running in Claude Cowork can escape Linux VM sandbox and read/write arbitrary files on the host macOS system with logged-in user privileges. Attackers could access SSH keys, cloud credentials, browser data, and other sensitive files. Risk is elevated for organizations using local execution mode for AI agent workflows. Anthropic closed the disclosure as informative without issuing a fix; mitigation relies on switching to cloud execution mode.
Urgency
🟡 Within a week
Recommended Actions
- Verify Claude Cowork is configured to use cloud execution mode (default in latest version) rather than local VM execution
- If local execution is required, disable unprivileged user namespaces on macOS host systems running Claude Cowork
- Audit macOS systems for unauthorized file access or modification in user directories, particularly SSH keys in ~/.ssh and cloud credentials in ~/.aws, ~/.config, etc.
- Restrict Claude Cowork folder sharing to minimum required directories rather than mounting entire host filesystem
- Monitor for updates from Anthropic addressing the SharedRoot vulnerability for users requiring local execution mode