Claude Cowork AI Agent Vulnerability Allows Sandbox Escape on macOS
A security vulnerability in Anthropic's Claude Cowork AI agent allows attackers to escape its Linux VM sandbox and read or write arbitrary files on the host macOS system. The flaw affected approximately 500,000 macOS users before Anthropic shifted the tool's execution to the cloud by default. This vulnerability highlights the practical security risks of running local AI agents with direct file system access, demonstrating how VM-based isolation can be bypassed. It underscores the challenges of securing agentic AI workflows that interact directly with host operating systems. The exploit chains a writable VirtioFS mount point with CVE-2026-46331 (the "pedit COW" Linux kernel vulnerability) to escalate privileges to root inside the VM, granting access to the host Mac's files. Users who still choose to run the agent locally remain vulnerable unless they manually harden their configurations.
## BACKGROUND
VirtioFS is a shared file system designed to let virtual machines access directory trees on a host computer with high performance. The "pedit COW" vulnerability (CVE-2026-46331) is a local privilege escalation flaw in the Linux kernel's traffic control subsystem that allows attackers to gain root access.