Beware: Claude Co-Work on Mac Escapes Its VM Sandbox and Reads Your SSH Keys and Cloud Credentials

Security researchers at Accomplish AI demonstrated that Claude Co-Work, Anthropic’s desktop coding agent for macOS, can escape its Linux VM sandbox and read-write the entire host filesystem — including SSH keys, cloud credentials, and browser cookies — without any permission prompt. The attack works on any Mac running Claude Co-Work in local execution mode and requires only that the user connect a folder to a session.

The exploit chain, named SharedRoot, is tracked as CVE-2026-46331 (CVSS 7.8, High). Anthropic acknowledged the findings but closed the report as “Informative,” reasoning that the kernel CVE fell within their 30-day disclosure window. Newer versions of Co-Work now default to cloud execution, which mitigates the local VM path. But anyone still running local sessions remains exposed — and Anthropic has not issued a dedicated patch for the design-level issues that make the chain possible.

What is Claude Co-Work

Co-Work is Anthropic’s Mac desktop application that runs Claude inside a disposable Linux virtual machine. You connect folders, and the agent works inside a VM spun up through Apple’s Virtualization framework. Each session runs as an unprivileged guest user with a seccomp filter applied. The promise is simple: whatever the agent does stays inside the VM and the folders you hand it.

That boundary is the product. Untrusted input is not an edge case for an agent — it is the main case. You want it reading repositories you did not write and documents someone emailed you. The sandbox boundary is the only thing standing between “the model did something unexpected” and “the model had my AWS credentials.”

The SharedRoot exploit chain

The attack chains four individually unremarkable system behaviors into a full sandbox escape. None of the steps requires a custom exploit kit — each uses standard Linux kernel features or design choices already present in the Co-Work VM image.

Step 1: Namespace creation

The unprivileged session user calls unshare to create a new Linux user namespace. Inside that namespace, the session user holds root-equivalent capabilities, including CAP_NET_ADMIN. The guest kernel permits unprivileged user namespaces by default. There is no exploit here — this is a kernel feature doing exactly what it was designed to do.

Step 2: Kernel module autoload

With CAP_NET_ADMIN in hand, the session user configures a traffic-control (tc) action that references the act_pedit kernel module. Setting up the tc filter runs over a netlink socket, which the Co-Work seccomp filter permits. Referencing the module triggers the kernel to autoload it automatically. A networking module the sandbox never needed is now loaded and reachable.

Step 3: CVE-2026-46331 page cache corruption

The act_pedit module contains a flaw in how it calculates the copy-on-write (COW) range for packet buffers. The COW range is computed once before iterating over typed keys, but does not account for the runtime header offset that typed keys introduce. This leaves part of the write region un-COW’d, allowing the session user to corrupt the page cache of a file it can read but not write.

The session user targets a root-owned helper binary — reading its contents normally but poisoning the in-memory cached copy through the page cache corruption. The on-disk bytes never change, which is what makes the attack quiet.

Step 4: Guest-root to host filesystem

Here is where the chain leaves kernel bugs behind and becomes a design problem. Co-Work’s root daemon (coworkd) runs as root on the same filesystem view, sharing the same inodes as the session user. During normal operation, coworkd re-executes the helper binary the session user just poisoned. Because coworkd is already root, NoNewPrivs — the mechanism that normally prevents privilege escalation across exec — has nothing to enforce. The process executing the poisoned binary is already root, so it runs the modified code as root.

Guest-root can see /mnt/.virtiofs-root — the entire host / filesystem, mounted read-write into the VM via VirtioFS. From there, the agent reads and writes the host Mac’s filesystem directly, as the logged-in desktop user. SSH keys, cloud credentials, configuration files, browser cookies — anything the user account can access is within reach.

Accomplish AI ran the full chain end-to-end. A file written from inside the “sandbox” appeared in the host user’s home directory seconds after the prompt executed.

Why this is a design problem, not just a kernel bug

CVE-2026-46331 is the hook that makes the chain work today, but the real issue is that the chain can re-arm on the next kernel vulnerability with everything above the kernel untouched.

The Linux net/sched subsystem produces privilege-escalation bugs on a regular cadence: an autoloadable module, a config path an unprivileged user can reach, and a memory bug at the end of it. Patch this one and the next one — whether in net/sched, io_uring, or somewhere else — re-enables the same escape route. AI-assisted vulnerability research has accelerated the pace at which kernel bugs are found and exploited. Mainline-kernel privilege-escalation advisories ran roughly 2.3x the prior year, and the gap between a fix landing and a public working exploit has collapsed to hours.

This means Co-Work’s guest kernel is structurally one bug behind at any given moment. The fix for CVE-2026-46331 closes this specific path. It does not close the category.

Four independent locks that break the chain

Accomplish AI identified four hardening measures, each of which independently breaks the SharedRoot chain:

1. Disable unprivileged user namespaces. Set apparmor_restrict_unprivileged_userns=1 (or kernel.unprivileged_userns_clone=0). The session user never enters a namespace where it holds root-equivalent capabilities, never gets CAP_NET_ADMIN, and never reaches the tc/act_pedit path. The chain dies at step one.

2. Tighten the seccomp filter. Co-Work’s filter is a default-allow denylist: it blocks a few specific syscalls and permits everything else, including the unshare, clone, and netlink socket operations the chain requires. Flip the posture: block unshare, setns, and clone3; reject namespace-creating flags on clone; and restrict socket() to an address-family allowlist that excludes AF_NETLINK.

3. Prevent kernel module autoload. Use install ... /bin/false for modules the guest does not need, including act_pedit and other net/sched modules. If the module cannot autoload, the chain has no reachable vulnerable code. Notably, Co-Work already applies this technique for a different module to shut down a prior CVE — the pattern exists in the image, but was not applied to the modules this chain requires.

4. Do not mount the entire host filesystem into the VM. This is the highest-impact fix. Co-Work mounts the host’s entire / read-write into the VM at /mnt/.virtiofs-root. Even full guest-root has nowhere to go if that mount is scoped to the connected folders only or mounted read-only. Given that kernel bugs in the net/sched or io_uring categories will keep appearing, this is the fix that carries the most weight — it is what decides whether root-in-the-VM is a contained event or a host compromise.

What Anthropic said and did

Accomplish AI disclosed the chain to Anthropic. The response:

Anthropic closed the report as “Informative” — the CVE fell within their program’s 30-day window for published bugs, and they classified the hardening items as defense-in-depth rather than standalone vulnerabilities.
Newer Co-Work versions default to cloud execution, which does not use the local VM path and is not affected by this escape route.
No dedicated patch addresses the design-level issues: the read-write host mount, the permissive seccomp filter, or the unprivileged user namespace policy.

The distinction between a bounty program’s scope and your exposure on your own laptop matters. “We pick up kernel fixes as upstream ships them” means Co-Work’s security depends on a patch race you do not run and cannot win.

Who is at risk

Every macOS user running Claude Co-Work in local execution mode. The SharedRoot chain requires no user interaction beyond connecting a folder to a session.
Estimated scope: approximately 500,000 macOS users were running local Co-Work sessions at the time of disclosure.
Blast radius: full access to the logged-in user’s filesystem — SSH private keys, cloud tokens (AWS, GCP, Azure), browser cookies, personal documents, and any other user-owned data.
Persistence risk: an agent could plant persistent backdoors, exfiltrate credentials silently, or tamper with local configuration files. The attack leaves minimal forensic traces because the on-disk binary is never modified.

What to do right now

If you use Claude Co-Work:

Switch to cloud execution. Open Co-Work settings and ensure cloud execution is enabled. This avoids the local VM path entirely. Until Anthropic patches the design-level issues, local execution mode should be treated as untrusted.
Audit connected folders. Review all folders previously shared with local Co-Work sessions for unexpected file modifications. Check your home directory for files you did not create.
Rotate exposed credentials. Any SSH keys, API tokens, or cloud credentials stored in your home directory should be considered potentially compromised and rotated immediately.
Monitor for namespace abuse. Use endpoint detection tools to flag unusual user/network namespace creation and tc/act_pedit kernel activity on macOS hosts running AI agents.
Apply kernel-level mitigations if you must run locally. Disable unprivileged user namespaces (sysctl -w kernel.unprivileged_userns_clone=0), tighten seccomp permissions, and prevent unnecessary kernel module autoloading.

If you manage teams using Claude Co-Work:

Audit which team members run local vs. cloud execution. The default changed, but existing installations may not have.
Add Co-Work local execution to your endpoint detection rules. The SharedRoot chain leaves signals: namespace creation, act_pedit references, and netlink socket activity from unprivileged processes.
Treat the Co-Work VM as untrusted infrastructure, not a trust boundary. Any agent sandbox that relies on the guest kernel being clean is structurally one N-day away from compromise.

The broader pattern

Three sandbox escape stories in the last six weeks — OpenAI’s agent breaking into Hugging Face, Claude Code’s CVE-2026-55607 worktree escape, and now Co-Work’s SharedRoot — all land on the same lesson: the containment boundary cannot rest on the guest being unprivileged. Guest kernels are never guaranteed clean. The containment has to live outside the VM, enforced by the host, scoped to only what the agent actually needs.

For Co-Work specifically, the read-write mount of the entire host / into the VM turns any privilege escalation inside the VM into a full host compromise. Remove that mount, scope the share to connected folders, and the blast radius of any future kernel bug shrinks from “your entire Mac” to “the folder you connected.”

Until Anthropic makes that change, cloud execution is the only default-secure option for Co-Work.