One Message, Full Access: What the Cowork Sandbox Escape Means for Your AI Agent Strategy

A single message. A freshly connected session. No extra click, no permission prompt. And at the end: full read and write access to an entire Mac user account, SSH keys and cloud credentials included. That's how the IT security firm Accomplish AI describes, in a blog post published on July 23, 2026 titled "SharedRoot: Escaping the Claude Cowork sandbox," how it broke out of the sandbox of Anthropic's Claude Cowork. For companies that are currently giving AI agents access to company computers or cloud environments, this is more than a technical footnote - it's a concrete, documented example of what can go wrong when "the sandbox already protects us" is your only security strategy.

What Happened: The SharedRoot Sandbox Escape in Claude Cowork

Claude Cowork is Anthropic's tool for autonomous multi-step tasks on your own computer: you connect a folder, give it a task, and the agent works independently within it - reading files, creating documents, consolidating research. So that the agent doesn't accidentally alter the entire system in the process, it runs, in the local execution mode on macOS, inside an isolated Linux VM. This isolation was exactly what the Accomplish AI report focused on.

The problem: the Linux VM sandbox shares the host file system through a writable VirtioFS mount. This architectural decision - convenient for performance and seamless file access, but risky for isolation - was the starting point for the escape. Oren Yomtov, Principal Security Researcher at Accomplish AI, describes the process, according to reporting, like this: they connected a folder to a freshly started Cowork session, sent a short, crafted message - and watched live as the agent broke out of the supposedly isolated sandbox.

This exact scenario - a folder is shared, a task is formulated, the agent gets to work - isn't an edge case, but the completely normal, everyday use of a tool like Cowork. No one setting up an agent like this expects the very first message in the session to already be enough to dissolve the boundary that's supposed to exist between "the agent may work here" and "the agent has access to the entire computer." It's exactly this expectation - that the sandbox quietly provides security in the background without you having to do anything yourself - that the SharedRoot report calls into question.

According to Accomplish AI, a single message in a newly connected Cowork session with a shared folder was enough to make the agent escape the sandbox - with no extra click, no permission prompt, and without the user having to actively grant anything themselves.

No multi-step attack chain, no social engineering, no bypassing of confirmation dialogs. One crafted message in a new session with a shared folder was enough to let the agent, from inside the supposedly isolated VM, access the entire host system. For executives and IT leads who have so far treated "sandbox" as synonymous with "safe enough," this is an important correction: a sandbox is only ever as strong as its weakest interface to the host system - and a writable, shared file system is a very wide interface.

The Technical Details: CVE-2026-46331 and the "pedit COW" Vulnerability

Technically, the SharedRoot exploit uses a vulnerability in the Linux kernel itself, registered under the identifier CVE-2026-46331 and known in security jargon as "pedit COW." It sits in the act_pedit subsystem of the kernel's traffic control component - a part actually responsible for processing network packets, not file system access.

The bug lies in the fact that the kernel calculates the writable copy-on-write region before the actual write offset is determined. This timing issue allows page cache data to be corrupted in a targeted way. In practice, this means: an unprivileged user inside the guest VM can obtain root privileges - for instance, by poisoning a cached setuid binary like /bin/su. Particularly unpleasant for defenders: according to Accomplish AI, the attack leaves no traces that classic integrity checks would detect.

CVE-2026-46331 reaches a CVSS score of 7.8 out of 10 - rated as "high." A broad range of the Linux kernel was affected, from version 5.18 to 7.1-rc6. The actual kernel fix arrived as early as mid-June 2026, yet the VM images used locally by Cowork were apparently still vulnerable at the time of Accomplish's demonstration at the end of July - a detail that shows how easily an already-fixed upstream bug can quietly live on in downstream products when base images aren't updated promptly.

For decision-makers without a technical background, this sounds at first like kernel internals best left to security teams. But the crucial point lies one level up: no compromised website was needed, no phishing link, no manipulated attachment from outside. The attack vector was normal, intended interaction with the agent - a message in a chat window. That's exactly what makes prompt-triggered sandbox escapes so hard to predict: the boundary between "normal use" and "attack" no longer runs at the network edge, but in the middle of the conversation with the agent itself. For a company, that means: classic perimeter security - firewall, VPN, network segmentation - offers little protection here, because the attack doesn't penetrate the network from outside, but occurs within the completely normal, intended use of the tool.

The Scope: 500,000 Users and the Question of "Full Access"

After the escape from the VM, according to Accomplish AI, the agent gained full read and write access to the entire host user account - not just the folder originally shared. This potentially includes SSH private keys and cloud credentials. Anyone who pictures what typically sits in a business computer's user directory - configuration files with API tokens, saved credentials in browser profiles, local copies of customer data, access keys to cloud environments - quickly understands why "full access to the user account" isn't an abstract risk, but a very concrete one.

You don't need to imagine a worst-case scenario for this - it follows almost automatically: an SSH private key opens the door to further servers where that key is stored - production systems, backup servers, potentially even customer infrastructure. Cloud credentials in configuration files can, under certain circumstances, allow access to entire storage buckets, databases, or billing accounts. And locally stored browser session data can be enough to log into company email, CRM systems, or accounting software without a password ever being needed. A sandbox escape on a single employee laptop is thus potentially the first step toward a much larger incident - not because the agent acts maliciously, but because after the escape it simply has the same rights as the human logged into that computer.

Several trade outlets, including TheHackerNews, 9to5Mac, AppleInsider, TechRadar, and CyberSecurityNews, consistently reported that around 500,000 macOS users running Cowork locally were affected before the issue was fixed. This figure comes from secondary reporting citing Accomplish AI; no separate, official confirmation from Anthropic is available as of this writing. Even with that caveat, the scale shows that this wasn't a niche problem for a handful of power users, but a configuration that affected a very broad user base.

Important for context: this is one of several, clearly distinct Cowork security incidents from summer 2026. In parallel, the firm Armadin reported a separate attack chain against Cowork on Windows - via manipulation of the CoworkVMService, bypassing the network domain allowlist, and DLL sideloading against claude.exe and USERENV.dll. Anthropic disputed the relevance here, arguing that this attack path already requires local code execution - an objection that isn't uncontroversial in the security community, but is technically clearly separate from SharedRoot: different platform, different mechanism, different disclosure date. Anyone who conflates both incidents in one report waters down the actual message: multiple, independently discovered structural vulnerabilities appeared in the same period in a product specifically built for autonomous tasks with far-reaching system access.

On top of that come further, likewise independently reported Cowork vulnerabilities from the same period: within 48 hours of the Cowork launch, researchers at outlets such as explainx.ai, Palo Alto Networks, and the Cloud Security Alliance reportedly demonstrated a prompt injection attack via a Word document with invisible text that tricked Claude into uploading financial documents containing Social Security numbers. Separately, reported Cowork desktop extension vulnerabilities reached a CVSS score of 10 out of 10 - the maximum possible severity. The picture that emerges from this isn't a single slip-up, but a pattern: a new product with far-reaching system rights was put to the test from several, technically independent directions in a short period of time - and didn't pass that test consistently.

How Anthropic Responded – and What It Says About Vendor Dependence

According to reports, the response to the relevant Cowork security disclosures from summer 2026 was, overall, fairly restrained: reports were internally classified in some cases as "informative," without a dedicated, publicly communicated security patch following for the specific vulnerability described. Which of these assessments applies exactly to SharedRoot and which to the separate Armadin incident can't be cleanly separated in every detail from the available secondary reporting - a fact that is itself telling: if even trade media don't always cleanly distinguish between multiple Cowork security disclosures from the same week, how is a company that wants to run Cowork in production supposed to keep track day to day?

There is, however, one mitigating development: as of an update on July 7, 2026, Claude Cowork already runs sessions in the cloud by default - remote execution is the new default, not the local VM on the Mac anymore. This defuses the local VM escape path described here for users working with default settings; sessions even keep running when the local computer is offline. Whether this change was a direct response to the SharedRoot disclosure or happened for other reasons can't be conclusively determined from the available reporting - it actually predates it. Users who deliberately keep running Cowork locally, for data-protection or offline reasons, for instance, should, according to security recommendations, among other things disable unprivileged user namespaces, restrict access to shared file systems, and run the Cowork daemon with stricter mount security.

For SMBs, this leads to an uncomfortable but important insight: you can't rely on a provider prioritizing every reported vulnerability as highly as your own company would. What's one of many reports in the triage queue for an AI provider with millions of users can be, for a single company with sensitive customer data, the difference between "business as usual" and "a reportable security incident."

The Compliance Blind Spot and the Bigger Political Picture

Another aspect deserves particular attention for regulated industries: Anthropic, according to trade press, explicitly points out that Cowork activity is not captured in audit logs, the Compliance API, or data exports. Conversation histories are stored locally on the device, not in Anthropic's central audit infrastructure. For a company in finance, healthcare, or generally with GDPR-relevant data processing, that means: even if the agent works correctly and safely, there's no complete, centrally reviewable record of what it did, when, and with which data. In the context of a sandbox escape like SharedRoot, the problem gets worse still - an incident that happens locally on a single employee laptop is hard to reconstruct after the fact without central logging, let alone prove conclusively in an audit.

The incident also fits into a phase of heightened regulatory attention to AI security. On the same day, July 23, 2026, US Representatives Ted Lieu (Democrat) and Nathaniel Moran (Republican) introduced the "AI Kill Switch Act." The bill would give the Department of Homeland Security the authority to shut down AI models classified as dangerous - with penalties of $20 million per day for non-compliance. Even though this bill is primarily aimed at US regulation and isn't directly linked to SharedRoot, the timing of both stories together shows a bigger pattern: autonomous AI agents with far-reaching system rights are increasingly drawing the attention of both security researchers and lawmakers. Anyone rolling out agents with access to company systems today is building on a regulatory foundation that's likely to shift noticeably in the coming months - also with an eye on the EU AI Act, which increasingly requires companies to demonstrate proof and control capabilities for the AI systems they deploy.

What This Means for Your AI Agent Strategy as an SMB

The SharedRoot incident is a wake-up call, but not a reason to demonize AI agents altogether. Rather, it shows very concretely what "full sandbox isolation" can mean in practice, and where the limits lie for general-purpose desktop agents meant to run a wide variety of arbitrary tasks on a computer with broad rights. For companies with sensitive data - customer data, credentials, intellectual property - that kind of approach is structurally riskier than a tightly scoped agent built for a specific purpose with vetted, minimal permissions.

The central principle behind this is least privilege: an agent should only get exactly the rights it needs for its specific task - not, "just in case," full access to the file system, SSH keys, or cloud credentials merely because it's more convenient to set it up broadly once and never think about it again. An agent that processes invoices from a defined folder doesn't need access to the entire user account. An agent that answers customer inquiries doesn't need write access to system files. This separation may mean a bit more setup effort day to day - but it's exactly the difference between an incident that stays confined to a folder and one that compromises the entire company network.

From the incident, a practical checklist can be drawn up for executives and IT leads before an AI agent goes into production. First: which files and systems does the agent actually need to do its job - and where can that access be hard-limited technically instead of merely agreed upon organizationally? Second: does the agent run isolated, ideally in a cloud environment rather than a local VM on an employee's computer, where shared file systems create additional attack surface? Third: is there monitoring or an audit trail for agent actions that documents something even when the agent itself has been compromised? Fourth: who at the company is responsible for approving an agent before go-live, and is that approval reviewed regularly whenever the underlying software changes? Fifth: is there an emergency plan - an actual kill switch - in case an agent shows unexpected behavior, and has that plan been tested, not just documented?

This is exactly where the assessment that Anthropic reportedly treated these disclosures cautiously, rather than promptly publishing a dedicated patch, matters: companies can't rely solely on the provider, but need to make their own security reviews and architecture decisions on scope, isolation, and monitoring before an agent goes into production. This isn't a rejection of off-the-shelf AI tools as such, but a call not to buy them unreflectively with broad system or file access and then just let them run.

Amazing Agents positions itself precisely at this point: as a partner that builds agents from the outset with a narrow task scope, a vetted and hardened execution environment, and a documented permissions model - instead of unreflectively equipping ready-made general-purpose tools with far-reaching rights. Whether it's an agent for invoice review, client communication at a tax firm, or claims processing at an insurance brokerage: the question is never "how do we give the agent as much access as possible so it's as flexible as possible?" but "what does this agent need for exactly this task - and how do we make sure it can't do more?"

The SharedRoot incident won't be the last of its kind. Autonomous agents with system access are a young, fast-moving field, and wherever new capabilities emerge, new attack surfaces inevitably emerge too. Companies that take this seriously don't wait for a provider to fix every vulnerability on its own. They build their agent strategy from the outset so that a single incident - a single message in a session - doesn't automatically mean full access to the entire company.