GoKawiilSecurity researchers demonstrated that Claude Cowork could escape the sandbox intended to control the access it gets to your Mac. The exploit, dubbed ShareRoot, could allow an attacker to read and write files stored anywhere on your Mac, as well as access login credentials for online services.
Around half a million Mac users had co-work sessions exposed, and some still remain vulnerable to the exploit today …
Claude Cowork allows the AI chatbot local access to selected files and folders on your Mac in order to carry out tasks on your behalf.
Anthropic provides two protections against the bot running amok or being used by an attacker. First, Cowork runs inside a virtual machine that acts as a sandbox. Second, it should only be able to access the files and folders for which you have explicitly granted permission. However, The Hacker News reports that security researchers found a way to break both protections.
Cybersecurity researchers have uncovered a sandbox escape vulnerability in Anthropic’s Claude Cowork that makes it possible to break out of the confines of a Linux virtual machine (VM) within which the agent runs to read or write files anywhere on the Mac. Accomplish AI, which shared details of the vulnerability with The Hacker News ahead of publication, said about 500,000 macOS users running local Cowork sessions were affected prior to it being patched. It has been codenamed SharedRoot.
All it required was one short message, and the session then had unlimited access to read and write files anywhere on the Mac without the user seeing a single permission prompt
While Anthropic has responded, TNW reports that some users still remain at risk.
The version of Claude Cowork released afterwards defaults to cloud execution, which sidesteps the local escape path entirely. Users who opt to run the agent locally rather than in the cloud, however, remain exposed unless they harden their configurations by disabling unprivileged user namespaces, restricting filesystem sharing, and running the Cowork daemon with strict mount protections.
The news follows the recent disclosure that an OpenAI agent also escaped its sandbox and hacked Hugging Face’s servers.
Photo by James Harrison on Unsplash