Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files

Anthropic's Claude Cowork, an AI agent tool used by approximately 500,000 macOS users, contains a sandbox escape vulnerability that permits attackers to break out of its Linux virtual machine container and access arbitrary files on the host Mac system.

Researchers at Accomplish AI discovered the flaw and disclosed it to The Hacker News prior to public release. The vulnerability undermines the isolation layer that confines Claude Cowork's operations to a sandboxed environment. By exploiting this escape, an attacker gains read and write access to files anywhere on an affected macOS machine, exposing user data and system integrity.

Claude Cowork functions as an autonomous AI agent designed to assist users with various tasks. Its architecture relies on Linux VM containerization to limit the agent's file system access and prevent it from modifying the host operating system. This sandbox design assumes strict boundaries between the agent's execution environment and the user's system. The discovered vulnerability defeats this assumption entirely.

The specifics of the exploit technique remain unclear from available details, but sandbox escapes typically exploit either kernel vulnerabilities, misconfigured container boundaries, or logic flaws in the virtualization layer itself. Once an attacker breaches the VM boundary, the absence of additional access controls on the macOS host allows unrestricted file operations.

For affected users, the risk spans data theft, system compromise, and credential harvesting. An attacker with file system access could extract browser cookies, SSH keys, application credentials, or sensitive documents stored on disk. Persistence mechanisms become possible through modification of startup scripts or system daemons.

Accomplish AI's disclosure timeline and Anthropic's patch status remain undefined at this stage. Organizations and individuals using Claude Cowork on macOS should monitor for security updates from Anthropic and consider limiting the agent's use on systems containing sensitive information until a patch is available. This incident underscores the challenges