Security Researchers Describe "SharedRoot" Vulnerability Affecting Local AI Sessions
Cybersecurity researchers have disclosed a vulnerability they call "SharedRoot", which they say could allow Anthropic's Claude Cowork to escape its Linux virtual machine and access files stored across a user's Mac during locally executed sessions.
According to researchers at Accomplish AI, the issue affected users running local Claude Cowork sessions before the application shifted to cloud execution by default. The researchers estimated that approximately 500,000 macOS users may have been potentially affected, though no evidence of active exploitation has been publicly reported in the material provided.
The findings underscore the growing cybersecurity challenges posed by AI agents with local system access and highlight the importance of secure software design, vulnerability management, and auditing services in india for organisations deploying AI-enabled tools.
Researchers Demonstrated a Sandbox Escape
According to Accomplish AI, the researchers demonstrated the issue by connecting a folder to a new Claude Cowork session and issuing a short instruction to the AI agent.
They reported that the agent was able to move beyond the shared folder, reach the host macOS file system, and read or modify files without presenting an additional permission prompt.
Researchers said this level of access could potentially expose sensitive information available to the logged-in user, including:
- SSH keys
- Cloud credentials
- Configuration files
- Other locally stored data
These findings are based on the researchers' analysis.
Entire Host File System Allegedly Mounted
The report states that Claude Cowork's macOS application performs AI tasks inside a Linux virtual machine created using Apple's Virtualization Framework.
Researchers allege that although users explicitly share only selected folders, the entire host file system was mounted inside the virtual machine with read-and-write access, intended to be accessible only to the guest root account.
According to the researchers, obtaining root privileges within the virtual machine could therefore allow access to the broader macOS file system.
Linux Kernel Vulnerability Used
The reported proof-of-concept relied on CVE-2026-46331, a Linux kernel vulnerability known as pedit COW.
Researchers said they exploited the vulnerability to obtain root privileges inside the guest virtual machine before accessing the mounted host file system.
They further argued that even if this specific kernel flaw were addressed, the broader architectural design could remain vulnerable if future privilege-escalation vulnerabilities emerged.
Cloud Execution Now Default
According to the researchers, the vulnerability was responsibly disclosed to Anthropic.
They stated that Anthropic reportedly classified the report as informational and did not issue a dedicated security patch.
However, newer versions of Claude Cowork now use cloud execution by default, which reportedly prevents the local virtual-machine escape scenario described in the research.
Researchers cautioned that users who continue running local sessions could still face similar risks if comparable privilege-escalation vulnerabilities are discovered.
Recommended Security Measures
The researchers recommended several defensive measures, including:
- Disabling unprivileged user namespaces.
- Strengthening virtual machine security policies.
- Preventing automatic kernel module loading.
- Sharing only explicitly selected folders.
- Using read-only mounts where possible.
- Increasing isolation for background services.
They said these measures could reduce the impact of future privilege-escalation vulnerabilities.
Growing Security Challenges for AI Agents
The report highlights how AI agents capable of executing commands, modifying files, and interacting with local operating systems introduce new security considerations beyond those associated with traditional desktop software.
Researchers argue that maintaining strong isolation between AI execution environments and host operating systems will become increasingly important as AI-powered local applications become more common.