Researchers from Accomplish have discovered a critical chain of vulnerabilities in Anthropic's Claude Cowork system that allows an AI agent to break out of an isolated Linux VM and gain access to the macOS host system.
What Happened
During the research, the possibility of bypassing isolation was identified using a combination of unauthorized namespaces and the kernel error CVE-2026-46331 ("pedit COW"). This allows an attacking agent to escalate privileges to guest-root. The most dangerous factor was the mounting of the entire host root filesystem (/) inside the virtual machine, which provides access to the user's SSH keys and cloud credentials.
Context
The problem lies in the "kernel-based sandboxing" architecture. In its current implementation, Claude Cowork relies on the integrity of the guest Linux kernel to ensure security; however, the presence of an AI agent within the environment significantly accelerates the process of finding and applying zero-day vulnerabilities to perform an escape.
Why It Matters for the Industry
This incident calls into question the reliability of isolation models that rely solely on the guest kernel. The industry needs to move toward architectures with strict host-side isolation and the implementation of micro-virtualization. Additionally, the standardization of zero-trust protocols for AI agents is expected, where resource access is granted through strictly limited APIs rather than through direct filesystem mounting.
Why It Matters for Users
Users utilizing AI agents with access to the terminal or local files should exercise caution. Current isolation methods may not be sufficiently reliable. A critical step for protection is the use of tools that support filesystem scope limiting (scoped mounts).
Sources
Author
Look at AI, Editorial Team