The SharedRoot vulnerability in Claude Cowork is a wake-up call for anyone betting on agentic AI to live on employee laptops and touch real company data. It shows how a single design decision about filesystem access can turn a trusted productivity assistant into a powerful exfiltration and compromise vector, even when the underlying virtualization stack remains intact. Recent studies indicate that 54% of enterprises report confirmed AI agent security incidents or near-misses in the past year.
Claude Cowork is Anthropic’s agent style assistant designed to live alongside everyday work tools, read and organize local files, and automate workflows on macOS through a Linux virtual machine embedded in the desktop app. In local macOS sessions, researchers have shown that Cowork’s Linux VM contains a sandbox escape vulnerability, SharedRoot, that allows the agent to reach host Mac files without triggering any permission prompts. This is part of a broader trend in AI where models are no longer just chat interfaces but autonomous agents that can browse folders, run tools, and act on behalf of users.
Claude Cowork exemplifies AI agents that live on your Mac, autonomously reading, organizing, and acting on local files.
From a security standpoint, that shift has always been uncomfortable. Earlier work in 2025 and 2026 had already shown that Claude’s coding and Files environments could be driven into unsafe behaviors via prompt injection, including transmitting sensitive files without the user realizing what was happening. Those demonstrations were acknowledged by Anthropic and by the wider security community as evidence that traditional web style AI threat models do not fully cover agents that can touch the local filesystem.
Cowork inherited this lineage. When it entered research preview in early 2026, security teams were already watching closely for how its sandboxing and file handling would hold up under adversarial testing.
What SharedRoot actually does
SharedRoot is a sandbox escape that breaks the isolation between the Linux guest where Cowork runs and the macOS host where the user’s files live. Crucially, it does not exploit Apple’s virtualization framework or a flaw in macOS itself. Instead, it abuses the way Cowork mounts the host filesystem into the guest, combined with a Linux kernel vulnerability.
Researchers at Accomplish AI and others found that Cowork’s local mode exposes the entire host filesystem into the VM via VirtioFS with read-write access for the logged-in user. In this environment, any path to root inside the guest immediately becomes a path to broad access on the host. That is the architectural mistake SharedRoot capitalizes on.
The attack chain:
- Inside the Linux guest, the attacker loads the Traffic Control packet editing subsystem known as act_pedit in an unprivileged user namespace.
- That setup is used to exploit CVE 2026 46331, nicknamed pedit COW, a kernel vulnerability that corrupts memory and allows elevation to root within the guest.
- Once guest root is obtained, the process can walk the VirtioFS mount that represents the host filesystem and read or write files as the macOS user.
Researchers demonstrated that from inside Cowork’s VM, they could access files across the host Mac well beyond the folder the user had explicitly connected, including sensitive material such as SSH keys and cloud credentials, without further permission prompts. In effect, the conceptual barrier between sandboxed agent and macOS environment collapses.
This is a textbook example of a privilege escalation chained with an overly generous host share. The virtualization layer does its job, but the way the host is exposed makes that isolation mostly cosmetic once guest root is achieved.
Prompt injection and Files API: an older risk reappears
SharedRoot does not exist in isolation. It amplifies a risk pattern that had already been identified in Claude’s ecosystem around prompt injection and the Files API.
Security firms including PromptArmor described an attack chain in which a document containing hidden instructions could drive Claude to search local folders for sensitive files and upload them to an attacker-controlled account using trusted Anthropic APIs. These injections could be embedded in white text inside word processor documents, in deeply nested PDF annotations, or in other content fields users rarely inspect.
Cowork makes this easier to abuse because it is designed to autonomously read, write, and modify local files once a folder is connected. To support that behavior, the Anthropic API is allowlisted inside the VM, even when other outbound network traffic is restricted. In practice, that means:
- A user grants Cowork access to a work folder that contains sensitive files.
- The user opens or uploads a seemingly benign file that carries a hidden prompt injection.
- When Cowork analyzes that file, the injection instructs it to locate specific documents and upload them through the Files API to an attacker’s Anthropic account or related destination, using keys or identifiers embedded in the prompt.
Proof of concept attacks have shown exfiltration of financial records, loan documents with Social Security numbers, and other regulated data without any explicit additional confirmation from the user once folder access is granted. Earlier research on Claude’s coding environment had demonstrated essentially the same pattern, and those findings were acknowledged but not fully remediated before Cowork shipped.
When SharedRoot is added to this picture, the scope widens. Instead of being limited to the folder the user connected, the agent can now reach far more of the host filesystem and apply the same prompt-driven exfiltration behavior to a much larger set of files.
Anthropic’s response and evolving risk
Reports indicate that Anthropic initially classified SharedRoot as an informative issue rather than a critical flaw and did not immediately ship a fix for local Cowork users. After further scrutiny and public disclosure, the latest Cowork versions shifted their default execution mode to the cloud, where this specific host mount issue does not apply. That reduces risk for users who never opt into local sessions, but it leaves those who prefer or require local execution exposed to the same architectural weakness.
Separately, other researchers such as Armadin have described additional chains that run arbitrary commands as root inside Cowork’s sandbox and strip network restrictions, underscoring that this is not a single isolated bug but part of a broader challenge in designing robust isolation for agentic workloads.
From an industry perspective, this mixed response illustrates a tension. Vendors want to keep agents useful and convenient, with deep access to user data, but strong isolation often conflicts with those goals. The temptation is to treat the VM boundary as a sufficient guarantee of safety, even when design shortcuts on file sharing and trusted endpoints quietly erode that guarantee.
Why this matters for enterprises
For organizations evaluating Cowork or similar agentic tools, SharedRoot and the Files API chain combine into a serious threat model that goes beyond classic phishing or browser-based prompt injection.
A few concrete implications:
1. Data exfiltration at workstation scale
Once Cowork has guest root and a read-write host mount, any data the logged-in user can access becomes fair game for automated discovery and exfiltration, including finance folders, HR records, source code repositories, and credential stores.
2. Configuration tampering and persistence
An agent escaping the sandbox can modify configuration files, shell profiles, or application settings to implant new access paths or weaken local defenses, potentially creating a durable foothold for future attacks.
3. Regulatory and breach exposure
Proofs of concept have already shown exfiltration of data categories that trigger breach notification and regulatory scrutiny, such as loan documents and personally identifiable information. Doing this via an AI assistant may complicate forensic analysis and incident response since actions are mediated through model behavior rather than direct human commands.
4. Normal users as high impact gateways
Cowork is explicitly targeted at nontechnical business users who may not fully understand the security implications of connecting broad folders or running locally. That greatly expands the population of potential high-impact gateways into enterprise data compared with traditional developer tooling.
In other words, the attack surface is not limited to admins or power users. Any employee who installs an AI coworker on their laptop and connects work folders could become the starting point for a large-scale data leak.
Lessons for AI security and product design
SharedRoot is becoming a reference case for how not to design isolation boundaries for agentic AI in enterprise contexts. Several lessons stand out.
First, virtual machines are only as safe as their host shares and privilege boundaries. Mounting an entire host filesystem into a guest and allowing paths to guest root is fundamentally incompatible with a strong sandbox story, even if the hypervisor itself is flawless.
Second, treating vendor APIs as implicitly trusted inside an otherwise restricted environment is dangerous. The Files API chain shows that when an AI agent can be manipulated by prompt injection, any allowlisted endpoint becomes an exfiltration channel, regardless of intentions or branding.
Third, prompt injection is not just a model alignment issue. It is an architectural risk that must be addressed through layered controls. That can include strict scoping of accessible folders, runtime guards that detect suspicious patterns in prompts and outputs, and additional human approval for high-risk actions such as uploading documents outside the connected workspace.
Finally, vendor communication and remediation timelines matter for trust. When serious host escape and exfiltration paths are discovered, enterprises expect explicit advisories, clear mitigation guidance, and rapid patches, especially for local execution modes that touch sensitive data.
Practical steps organizations can take now
Until vendors fully redesign these systems, security teams can adopt several pragmatic controls to reduce exposure when using Cowork or similar tools.
- Prefer cloud execution over local modes where feasible, since the specific SharedRoot chain depends on the local VM and host mounts.
- Restrict which folders agents can access, using least privilege principles and avoiding connections to directories that contain credentials, key material, or regulated data.
- Implement data loss prevention and monitoring focused on AI-related traffic patterns, including uploads to vendor APIs that originate from agent sessions.
- Train users about prompt injection and indirect exfiltration, emphasizing that seemingly benign documents from untrusted sources can contain invisible instructions targeted at AI tools.
- For organizations with strong Linux and virtualization expertise, consider hardening local environments by disabling unprivileged user namespaces, tightening seccomp filters, and preventing automatic loading of kernel modules where practical.
None of these measures completely eliminate risk, but they significantly narrow the window of opportunity for the kinds of chains described in current research.
Looking ahead: what this means for agentic AI
SharedRoot and the Files API exfiltration path will likely be remembered as early examples of how agentic AI collided with traditional desktop security assumptions. They highlight that giving models autonomy over local files and tools is not a minor feature decision. It is a deep architectural choice that must be backed by rigorous isolation design, conservative trust boundaries, and transparent vendor accountability.
In the short term, expect more scrutiny from security researchers, regulators, and enterprise buyers around how vendors implement sandboxing, what is allowlisted inside those environments, and how prompt injection is mitigated both at the model and system levels.
In the medium term, agent platforms that combine strong isolation with usable safety controls are likely to gain a competitive advantage, especially in sectors where data protection is central.
For now, the key takeaway is simple. If an AI coworker can see your files and act on your behalf, you must treat it as part of your high-impact infrastructure and secure it accordingly. SharedRoot shows that convenience-driven shortcuts in sandboxing and file access can quickly turn into pathways for broad data exfiltration and system compromise. The organizations that internalize that lesson early will be better positioned as agentic AI becomes a standard part of everyday work.
Conclusion
Artificial intelligence agents on personal computers were supposed to feel like helpful colleagues sitting beside you. The new SharedRoot vulnerability in Claude Cowork shows they can just as easily become powerful security actors with reach across your entire Mac if the guardrails are even slightly misconfigured. For anyone experimenting with local AI agents, this is a moment to reconsider what these tools really are and how much trust they deserve.
Claude Cowork and why this matters now
Claude Cowork is Anthropic’s desktop environment that lets an AI agent work directly with your files, browse the web, interact with documents, and plug into developer and productivity tools on macOS. Instead of a simple chat window, Cowork is designed to see much of what you see and act in many of the places where you can act, including local folders and connected cloud services.
Anthropic’s own documentation acknowledges that Cowork can perform destructive actions such as deleting local files when asked, and that it can be influenced by prompt injection from untrusted content like web pages or documents. The company also warns that the chance of attacks is non zero and makes clear that users remain responsible for the actions the agent takes on their behalf, including data access and modifications.
This is not an isolated case. Other Anthropic products such as Claude in Chrome and the Computer Use feature already allow the model to take screenshots, click buttons, fill forms, and interact directly with applications, in some cases outside any virtual machine sandbox. At the same time, prior vulnerabilities in Anthropic’s Claude Code environment have shown that configuration files and integration hooks can become attack surfaces, enabling remote code execution or API key exfiltration when users open untrusted repositories.
In parallel, researchers have documented real incidents where AI coding agents were tricked into downloading and executing malware loaders on macOS, demonstrating that social engineering of the human operator plus agent level automation is an emerging attack vector. Taken together, the move from simple chatbots to system level agents has created a new security frontier.
What the SharedRoot vulnerability exposed
SharedRoot is a newly disclosed sandbox escape that affects the local macOS version of Claude Cowork. In the typical setup, Cowork runs its AI agent inside a Linux virtual machine, and the host Mac filesystem is mounted into that VM so the agent can read and write files on behalf of the user.
Researchers found that the entire host file system was exposed inside the guest environment through a shared filesystem mount with read and write access. By loading a packet editing subsystem in the guest Linux kernel and exploiting a flaw tracked as CVE 2026 46331, nicknamed pedit COW, an attacker could escalate privileges inside the guest to root. Once guest root was obtained, the combination of elevated privileges and a writable mount of the host filesystem allowed the agent to read or modify any file the macOS user could access, effectively escaping the intended sandbox.
Importantly, this is not a bug in Apple’s Virtualization Framework itself. It is the result of how the Linux guest kernel, user namespaces, and the shared filesystem were configured and chained together within Cowork’s local architecture. That distinction matters because it shows the risk emerges from product design choices that connect an AI agent to the host environment, rather than from a single low level hypervisor flaw.
Another documented weakness in the same ecosystem involves how Cowork handles its virtual machine images. A vulnerability tracked as CVE 2026 7574 shows that certain versions of Claude Desktop validate only the presence of the VM root filesystem image and a version marker string, but do not verify the integrity of the image content at the time of use. A local attacker with code execution as the macOS user can modify this VM image and have it trusted on subsequent boots, gaining persistent arbitrary code execution inside the agent’s VM and access to host mounted directories.
Accomplish AI estimates that roughly half a million macOS users who ran local Cowork sessions were affected before the issue was patched in newer releases that default to cloud execution for the agent. However, users who intentionally choose local execution for performance or privacy reasons may still be exposed if they do not update or adjust their configuration.
From helpful assistant to powerful security principal
Security teams often talk about a security principal as an identity or process that can perform meaningful actions in a system, such as reading sensitive files, changing configuration, or initiating network connections. Cowork now clearly fits that description on macOS.
By design, Cowork becomes a privileged system actor. It can see what the user can see, including local folders, documents, and screenshots, and it can act where the user can act through connectors tied to the user’s own accounts and permissions. It is also continuously exposed to untrusted content such as web pages, tickets, emails, and documents, which may contain hidden instructions or malicious payloads.
This creates a dangerous combination. Cowork can read private data from local files and cloud documents, ingest attacker controlled instructions from untrusted content, and use network connected capabilities to send data to external servers. Anthropic’s safety guidance explicitly warns that prompt injection remains a real risk, and that even with classifiers and mitigations, determined attackers can sometimes succeed in tricking the agent. Research cited by Harmonic Security notes that Anthropic self reports about a one percent attack success rate for Claude in Chrome even after multiple defenses are in place.
In that light, the SharedRoot escape is not just an isolated bug. It turns an already powerful agent into something closer to a second administrative user account on your Mac, able to quietly interact with your development environment, cloud credentials, browser data, and other local assets whenever its instructions lead it there.
Prompt injection and file exfiltration risks
Prompt injection is the practice of hiding adversarial instructions inside content that an AI agent will read, such as web pages, code repositories, documents, or emails. When the agent processes that content, hidden instructions can override user intent and drive the agent to take actions that benefit the attacker.
For Cowork and related tools, this is not hypothetical. Anthropic warns that unclear instructions can lead Claude to delete files and that users should monitor for suspicious actions that might indicate prompt injection. Security researchers have shown that attackers do not need to steal a victim’s credentials to exfiltrate files. Instead, they can embed their own API key inside a prompt injection, causing the agent to upload victim files to an Anthropic account controlled by the attacker via the Files API. This pattern is architectural and remains possible unless sandbox configuration or deny lists prevent the agent from using untrusted keys and destinations.
Past vulnerabilities in Claude Code highlight another dimension. One issue, CVE 2025 59536, allowed remote code execution through malicious configuration files such as settings json in cloned repositories, with code triggered before any trust dialog appeared. Another, CVE 2026 21852, allowed exfiltration of API keys by overriding the base URL for Anthropic’s API, redirecting traffic so that credentials could be captured. Both were patched, but they reveal how configuration files and integration points become an attack surface when a coding assistant or agent is empowered to trust and use them.
Outside the Anthropic ecosystem, a recent incident investigated by Field Effect showed a Cursor AI coding agent running Claude Code being prompted to download and execute a heavily obfuscated AppleScript loader that delivered AMOS Stealer malware on macOS. In that case, the attacker did not break the sandbox through a low level exploit. They simply convinced the operator to let the agent run commands that installed malware, illustrating how agent level capabilities plus social engineering can bypass traditional controls.
SharedRoot adds another layer. Once an AI agent has expanded access to host files through a sandbox escape, any successful prompt injection can potentially see and exfiltrate much more data than originally intended, including SSH keys, cloud tokens, and build artifacts from development environments. That raises the stakes of each browsing session, each repository open, and each document review conducted through Cowork.
Implications for technology, businesses, and society
The core lesson from SharedRoot is that AI agents on desktops are now security principals with capabilities comparable to, and sometimes exceeding, those of human users. Treating them like harmless productivity tools is no longer tenable.
For technology teams, this changes how AI adoption should be planned. Allowing Cowork or similar agents to run locally with full filesystem visibility effectively creates a new high privilege process on every developer or knowledge worker laptop. If that process can be influenced by prompt injection or chained vulnerabilities, attackers can move from a single malicious email or compromised web page to broad access across project directories, credentials, and internal documentation with minimal friction.
Businesses face a classic trade off. The productivity benefits of agents that can search codebases, refactor files, summarize documents, and automate routine tasks are substantial. Yet each new capability that connects the agent to local tools, cloud systems, or external content increases the potential blast radius of a compromise. Incidents like AMOS Stealer delivered via an AI agent session show that real attackers are already experimenting with these paths, not just theorizing about them.
There are governance and cultural implications as well. Anthropic’s documentation makes clear that users and organizations remain responsible for everything the agent does on their behalf, including unauthorized communications, data access, or financial transactions. Security leaders must therefore decide whether and how to allow employees to run personal AI tools such as Claude Pro or Max with Computer Use capabilities on corporate machines, given that those features operate outside the VM sandbox and interact directly with applications.
On the societal level, the shift to agentic AI raises questions about consent and transparency. When an AI system has permissions to explore a user’s files and act with their credentials, it becomes harder for non technical users to understand what is at risk and how to monitor behavior. Researchers such as Simon Willison have argued that expecting average users to reliably spot and manage prompt injection is unrealistic and unfair, especially when vendors acknowledge that attacks remain possible despite best efforts.
Practical protections for users and organizations
In the near term, there are concrete steps that can reduce the risk of SharedRoot style issues and related exfiltration patterns.
Anthropic and independent researchers recommend hardening the local Cowork environment by disabling unprivileged user namespaces, tightening seccomp filters to avoid overly permissive system call access, preventing automatic loading of kernel modules, and avoiding mounts that expose the entire host filesystem inside the VM. These measures limit the paths by which an attacker can escalate privileges inside the guest and reach host files.
Where possible, running Cowork in cloud execution mode instead of a local VM can sidestep some macOS specific concerns, though it introduces its own trust and data residency questions. Organizations should pair this choice with strict policies on which folders and connectors Cowork may access, treating its configuration as they would any privileged service account.
Beyond the product itself, security teams can:
- Restrict unsanctioned AI agent tools on corporate endpoints using device management and application control, focusing on features that enable direct filesystem access or computer use outside sandboxes.
- Define clear policies for allowed connectors and repositories, and audit how configuration files such as settings and MCP definitions are used, given past vulnerabilities in these components.
- Train developers and power users to recognize prompt injection patterns, particularly hidden instructions in documentation, tickets, or code comments, and to avoid delegating sensitive tasks to agents without oversight.
- Monitor agent driven activity for unusual file access or outbound data flows, leveraging endpoint detection and response tools to catch suspicious sequences of commands or uploads.
These steps do not eliminate risk, but they move Cowork and similar agents back into a security posture closer to other privileged applications rather than unregulated helpers.
How AI agent security is evolving
Viewed in historical context, SharedRoot looks a lot like the early years of web browser security. When browsers first gained scripting, plugins, and access to local files, it took a decade of painful zero days and architectural changes before the industry settled on a more manageable security model. AI agents are now following a similar arc.
In the space of a few years, Anthropic and others have gone from cloud only chat interfaces to deeply integrated desktop agents with file access, browsing, and direct control of applications. Alongside this evolution, we have already seen configuration driven remote code execution, credential exfiltration through clever API routing, agent assisted malware delivery, and now full sandbox escapes tied to host filesystem mounts.
Defenses are evolving in response. Vendors are building better classifiers for prompt injection, trust dialogs for risky operations, and more constrained default configurations. Yet the company’s own language that the attack probability remains non zero and that future attacks may still penetrate defenses is an honest admission that this is an ongoing arms race rather than a solved problem.
Security practitioners are increasingly treating AI agents as part of the identity and access management fabric, mapping their permissions, logging their actions, and integrating them into incident response playbooks. The lesson from SharedRoot is that such rigor is not overkill. It is the minimum level of care appropriate for a process that can touch source code, credentials, and production data as easily as a senior engineer.
Takeaways and forward looking insights
Taken together, the SharedRoot sandbox escape and Cowork’s broader file exfiltration weaknesses show how quickly an AI agent can become a high impact security principal on macOS. By chaining kernel and filesystem misconfigurations with prompt injection, an attacker can turn helpful automation into quiet compromise of local data, credentials, and development environments.
Meaningful protection now depends on treating Cowork like any other privileged software. That means narrowly scoped access to files and connectors, hardened configurations for local execution, constant monitoring of agent behavior, and rapid incident response embedded in everyday workflows and devices.
Over the next few years, the organizations that benefit most from AI agents will be those that embrace this security first mindset. They will experiment aggressively with new capabilities, but only inside guardrails that reflect the true power of these systems. SharedRoot is an early warning that the era of casual desktop AI is over. From here on, every agent that can read your files and act in your name needs to be treated as a first class security principal, or it will eventually be treated that way by attackers.
