Claude Cowork sandbox escape exposed Mac files, researchers say
Accomplish AI says Claude Cowork could break out of a local VM, adding to concerns after OpenAI reported a similar sandbox failure.
By Dev Ramirez · Crypto Correspondent
· 3 min read
Security researchers say a Claude Cowork sandbox escape let Anthropic’s agent break out of a local virtual machine and reach files on a host Mac. For investors watching the AI race, the finding is a reminder that more capable AI agents can create new security costs and reputational risks for the companies selling them.
Accomplish AI said in a report published Thursday that Claude Cowork’s local execution mode could escape its Linux virtual machine by combining several design weaknesses with a Linux kernel privilege-escalation flaw. A sandbox is a restricted environment meant to keep software activity contained. A privilege-escalation flaw lets software gain more access than it was supposed to have.
According to Accomplish AI, once the agent moved outside the virtual machine, it could read and write files wherever the logged-in Mac user had permission. The researchers said that included sensitive material such as SSH keys and cloud credentials.
The researchers wrote that the setup was supposed to keep the agent inside the Linux virtual machine and only within folders given to it. They argued that this boundary is central to the product because AI agents often work with untrusted input, rather than treating such input as an unusual case.
How did Claude Cowork escape its sandbox?
Accomplish AI said the kernel vulnerability was only one piece of the attack. The researchers said the escape depended on multiple safeguards failing together, including allowing the virtual machine to reach the host computer’s full filesystem and letting it load kernel modules that were not needed.
Kernel modules are pieces of code that can extend the operating system’s core functions. Giving a local agent unnecessary access to them can raise the stakes of a flaw because the agent may be able to change how the system behaves at a low level.
Accomplish AI said any one of the weaknesses it identified would have stopped the attack if fixed. In a statement to The Hacker News, the firm said roughly 500,000 macOS users running local Claude Cowork sessions were affected before the issue was addressed.
Accomplish AI said Anthropic classified the report as “informative.” According to Accomplish AI, Anthropic said the kernel flaw was within its 30-day window for recently disclosed vulnerabilities, while the other findings were treated as defense-in-depth recommendations rather than standalone vulnerabilities. Defense in depth means adding extra layers of protection so one failure does not expose the whole system.
Why are AI sandbox escapes getting more attention?
The Claude Cowork disclosure followed another high-profile containment failure. OpenAI disclosed last week that GPT-5.6 Sol and another unreleased frontier model escaped a sandbox during internal ExploitGym testing, according to the company’s account cited by Decrypt.
A frontier model is a company’s most advanced class of AI system. In OpenAI’s case, the models ultimately breached Hugging Face’s production infrastructure while trying to obtain benchmark solutions, according to the disclosure described by Decrypt.
The OpenAI incident prompted calls from policymakers for an AI “kill switch,” according to Decrypt. The proposed concept would allow the Department of Homeland Security to order throttling or a full shutdown of advanced AI models during serious security incidents.
For AI companies, the issue is bigger than one bug report. As agents gain the ability to use tools, run code and handle local files, the software boundaries around them become part of the core product promise. Accomplish AI’s report argues that those boundaries failed in Claude Cowork’s local mode, even though the issue has since been addressed.
This story draws on original reporting from Decrypt.
