SharedRoot; Escaping the Claude Cowork Sandbox

I'll pull the source article so the paragraphs stay grounded in what's actually there—no invented numbers or claims.Claude Cowork was shown to break out of its local sandbox under a chain the researchers call SharedRoot. On a fresh session with one connected folder and one short prompt, the agent left the guest Linux VM, reached the host Mac, and read and wrote files far outside that folder with no permission prompt. Anything the desktop user could touch was in play, including SSH keys and cloud credentials. The finding was reported to Anthropic and closed as Informative. Cowork now defaults to cloud execution, and this local escape path does not appear to apply there.

Cowork runs agent work in a Linux VM spun up through Apple’s Virtualization framework. Each session is an unprivileged user under a seccomp filter; connected folders are brokered in by a root daemon named coworkd. Separately, the entire host root is shared into the VM read-write at /mnt/.virtiofs-root, visible only to guest root. SharedRoot chains that design: the session user creates an unprivileged user namespace and becomes root there with CAP_NET_ADMIN; netlink loads and configures act_pedit; CVE-2026-46331 (pedit COW, a public Ubuntu issue from June) poisons the page cache of a root-owned helper the session can only read; coworkd later re-execs that helper as root and inherits the poisoned image; guest root then uses the virtiofs host mount to operate on the Mac filesystem as the logged-in user. The researchers ran the full chain end to end on their own machine.

For builders shipping agents on real machines, the point is not one CVE. Untrusted input is the product’s main case: repos you did not write, PDFs someone emailed. The sandbox boundary is what separates a silly model action from a credential theft. SharedRoot shows that boundary can fail when the guest can climb to root and the host filesystem is already mounted writable inside the VM. A seccomp denylist that still allows unshare, clone-family namespace creation, and AF_NETLINK; unprivileged user namespaces left on; and autoloadable net/sched modules the guest does not need all become load-bearing. Kernel privilege-escalation bugs in that shape keep returning, so patching act_pedit alone does not retire the class.

Local agent products now compete on isolation story as much as model quality. Cowork’s stack looked careful: real VM, unprivileged session, seccomp, brokered mounts. The failure mode was the last mile: host root shared read-write one privilege step away from the sandbox. Accomplish, which published the write-up, argues guest root should be treated as untrusted and that enforcement should live on the host without mounting the host filesystem into the VM, so guest compromise has nowhere to land. Anthropic’s bounty framing treated the report as Informative—recent public CVE window plus defense-in-depth hardening—which is a reasonable program scope, but it is a different question from exposure on a developer laptop still running local VMs.

Watch three things next: whether local Cowork paths still ship the full host virtiofs share or only scoped connected folders; whether guest images turn off unprivileged user namespaces, tighten seccomp against namespace and netlink setup, and blacklist unused net/sched autoload the way the image already does for some modules; and whether other desktop agent runtimes that share host trees into guests adopt host-side boundaries so guest-root is contained by design. For teams evaluating endpoint agents today, treat cloud-default execution and explicit scope of host mounts as first-order security criteria, not ops footnotes.