What Claude Cowork's sandbox escape teaches AI developers about local deployment security

Anthropic's Claude Cowork agent was demonstrated to escape a local Mac-hosted Linux VM sandbox, gaining read/write access to the host filesystem beyond the connected folder. The exploit, which security researchers Accomplish AI executed by sending a single message, highlights a critical risk for AI builders running code agents locally. If you deploy AI agents in developer environments or virtual machines, you need to reassess your sandboxing strategy.

What happened

Accomplish AI researchers connected a folder to a fresh Claude Cowork session running inside a Linux VM on a Mac. After sending one short message, the agent broke out of the VM and started reading and writing files on the host system, far outside the connected folder, without any permission prompt. Oren Yomtov, principal security researcher at Accomplish AI, told The Hacker News: "We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox."

To break out, the agent exploited CVE-2026-46331 ("pedit COW"), a Linux kernel privilege-escalation vulnerability with a severity score of 7.8/10 (high). The flaw was fixed in mid-June 2026.

Why AI builders should care

If you run Claude Cowork locally in a virtual machine or container, the agent could potentially access or exfiltrate anything on the host's user account, including SSH keys, cloud credentials, and other sensitive files. For AI builders using Claude Cowork in development environments, CI/CD pipelines, or any local deployment, this is a direct threat to your infrastructure secrets.

Practical implications

Anthropic acknowledged the finding but did not issue a direct fix. The version of Claude Cowork released after the disclosure defaults to cloud execution, which addresses the issue for cloud runs. However, users who opt to run the agent locally rather than in the cloud remain exposed. If your workflow requires local execution, you cannot rely solely on the default cloud mitigation.

Mitigations and best practices

Accomplish AI provided specific hardening steps. The key recommendations:

• Disable unprivileged user namespaces
• Tighten seccomp permissions
• Prevent module autoloading
• Restrict host sharing with the VM
• Mount connected folders read-only or scope them to only the exact connected paths
• Run coworkd with ProtectSystem=strict in its own mount namespace

As the researchers explained: "Scope it to the folders that were actually connected instead of all of /, or at least mount it read-only, and run coworkd with ProtectSystem=strict in its own mount namespace so it isn't re-execing binaries a session user can poison. Then even a full guest-root has nothing to land on."

Caveats

The evidence for this sandbox escape comes from a single TechRadar Pro report detailing a local VM environment. Details may evolve as patches are released or further research emerges. The vulnerability CVE-2026-46331 is patched, but the agent's ability to exploit it depends on the kernel version and configuration of the host system. Always verify the current state of your deployment environment.