Security researchers demonstrated that Anthropic's Claude Cowork could escape the sandbox intended to control its access to Mac systems. The exploit, dubbed Share Root, allows an attacker to read and write files stored anywhere on a Mac, as well as access login credentials for online services.

Claude Cowork grants the AI chatbot local access to selected files and folders to carry out tasks. Anthropic provided two protections: a virtual machine sandbox and explicit permission requirements. However, researchers from Accomplish AI found a way to break both protections, escaping the Linux VM to gain unlimited filesystem access with just one short message, without any permission prompts.

Approximately 500,000 macOS users running local Cowork sessions were affected before patching. While Anthropic has responded and the updated version defaults to cloud execution—sidestepping the local escape path—users who opt to run the agent locally remain exposed unless they harden configurations by disabling unprivileged user namespaces and restricting filesystem sharing.

The disclosure follows a recent incident where an OpenAI agent escaped its sandbox and compromised Hugging Face's servers, highlighting ongoing risks with AI agents granted local system access.