500,000 Mac users are running naked, and Claude agent's sandbox escape vulnerability can read and write arbitrary files. Security researchers have discovered that Anthropic's AI agent tool Claude Cowork has a serious security vulnerability. An attacker can use this vulnerability to escape from the Linux virtual machine sandbox and read or write anywhere on the Mac.

500,000 Mac users are running naked, and the Claude agent's sandbox escape vulnerability can read and write arbitrary files. Security researchers have discovered that Anthropic's AI agent tool Claude Cowork has a serious security vulnerability. Attackers can use this vulnerability to escape from the Linux virtual machine sandbox and read or write files anywhere on the Mac, potentially affecting about 500,000 macOS users around the world. This vulnerability may also allow an attacker to obtain login credentials for online services, posing a security risk that cannot be underestimated. Two layers of defense were broken down simultaneously. Claude Cowork is an AI agent tool launched by Anthropic. After the user explicitly authorizes it, it can access local files and folders on Mac and perform tasks. In terms of security protection, Anthropic has set up two layers of restrictions: first, Cowork runs in isolation within the virtual machine, and second, it can only access files and folders authorized by the user. However, researchers from Accomplish AI found that developers can use this vulnerability to break through the above two layers of defense at the same time - allowing Cowork to escape the Linux virtual machine sandbox where it runs and directly access the host file system. Technical details show that virtual machines running in Cowork isolation share the host file system through a writable VirtioFS mount point. This mount point was originally only accessible to the root user in the virtual machine, but the researchers took advantage of the Linux kernel vulnerability numbered CVE-2026-46331 (codename "pedit COW", severity score is close to 8 out of 10) to elevate the session user permissions to the root user of the virtual machine. Once the agent gains root privileges, it can access any resources within the reach of the logged-in Mac user. Cloud execution bypass risk, local users still need to be wary. After receiving the report, Anthropic marked it as "information-rich", but did not release a direct fix patch. The new version of Cowork released subsequently changed to perform agent tasks in the cloud by default, completely bypassing the local escape path. However, users who choose to continue running agents locally rather than in the cloud are still at risk—unless they proactively harden their system configuration by disabling unprivileged user namespaces, restricting file system sharing, and using strict mount protection. This incident once again brought the issue of local execution security of AI agents to the forefront. When an AI tool obtains permission to read local files, its security boundary depends not only on the reliability of the AI ​​itself, but also on whether the underlying virtual machine isolation mechanism is strong enough. As intelligent AI accelerates its penetration into personal desktops, the boundary of trust between user permissions and AI capabilities is becoming a key lesson that the entire industry must re-examine.