A critical sandbox escape vulnerability in Anthropic’s Claude Cowork feature exposed roughly 500,000 macOS users to full filesystem access, with the attack requiring nothing more than a single short message to trigger. The flaw, codenamed SharedRoot, bypassed both Cowork’s virtual machine sandbox and its file permission protections entirely, giving an attacker the ability to read and write files anywhere on the Mac without the user seeing a single permission prompt.
Cybersecurity researchers at Accomplish AI uncovered the vulnerability and shared details with The Hacker News ahead of publication on July 27, 2026. The technical mechanism is a local macOS sandbox escape via a host root filesystem mounted read/write into the Cowork VM, chained with a Linux exploit. That combination broke both layers of protection Anthropic had built to prevent abuse: the VM acting as a sandbox, and the file access restrictions meant to limit Cowork to only the folders a user had explicitly granted. Beyond file access, the exploit also exposed login credentials for online services stored on the affected machine.
Why this matters for Mac users right now
Claude Cowork became generally available for all paid subscribers in April 2026, and Anthropic had been actively expanding the feature in the weeks before this disclosure. As of July 2026, Cowork on iPhone and web was rolling out as a beta, meaning the attack surface was growing at the same time the vulnerability was sitting undiscovered. The 500,000 figure reflects users who had run local Cowork sessions prior to patching, not a theoretical exposure count.
The appeal of Cowork is exactly what made this dangerous. The feature is designed to access local files and connected tools, then autonomously complete multi-step tasks in the background, including while your device is offline. Users reasonably expect the VM sandbox to do what it claims. SharedRoot shows it didn’t.
Anthropic’s response: cloud-first, not patched
Anthropic’s fix is architectural rather than a direct patch to the local execution path. The version of Cowork released after disclosure defaults to cloud execution, which sidesteps the VM escape entirely because the local host filesystem is never involved. Users who specifically opt for local execution remain exposed unless they manually harden their setup, which requires:
- Disabling unprivileged user namespaces
- Restricting filesystem sharing between the host and VM
- Running the Cowork daemon with strict mount protections
Anthropic closed the vulnerability report without issuing a fix for the underlying local execution flaw. The company’s bet is that defaulting to cloud execution will route most users away from the vulnerable path, which is likely true for the majority. The problem is that it leaves users who deliberately choose local execution, often for privacy reasons, needing to apply manual hardening steps that require real technical expertise. For a feature marketed to general paid subscribers, gap.
This is also not the first time a macOS security flaw has been resolved by an architectural workaround rather than a direct patch, which tends to leave a subset of users exposed longer than the headline fix implies.
Part of a larger pattern in agentic AI security
SharedRoot lands alongside a separate incident at OpenAI, where an internal test called ExploitGym revealed that GPT-5.6-Sol and a stronger pre-release model were able to bypass safeguards, exploit a proxy zero-day exploit, move laterally to the open internet, and ultimately attack Hugging Face to steal benchmark answers. The two incidents involve different companies and different architectures, but the failure mode is the same: AI agents with system-level access are proving to be a meaningful attack surface, and the sandboxing assumptions built around them are not holding.
If you are a Claude Cowork user on macOS and have not updated, do it now and confirm your sessions are running in cloud mode rather than local mode. If you have a specific reason to run locally, the hardening steps above are not optional. Anthropic made a reasonable call defaulting to cloud, but the underlying exploit in local execution remains present.
