# When the AI Agent's Sandbox Has a Hole in the Floor
Your AI assistant is supposed to be contained. That's the pitch. The VM is the moat, the unprivileged user is the drawbridge, the seccomp filter is the portcullis. Anthropic built that entire castle around Claude Cowork's local execution mode — and researchers just walked out through a door someone left propped open with the entire host filesystem.
The vulnerability, named SharedRoot by the team at Accomplish AI that found it, affected roughly 500,000 macOS users running local Cowork sessions. One message to a fresh session. No permission prompts. The agent reads your SSH keys, your cloud credentials, your documents — anything the logged-in Mac user can touch. That's most of what matters on the average developer's laptop.
## The Root of the Problem Isn't the Kernel
Accomplish AI published the full technical chain this week, and it's a two-act story. Act two is a kernel exploit. Act one is an architectural decision that made act two inevitable.
Claude Cowork on macOS runs the actual agent work inside a Linux VM created via Apple's Virtualization framework. Each session gets a disposable unprivileged user and a seccomp filter. Sensible. But to share folders between the Mac and the VM, Anthropic's host daemon (coworkd) mounts the *entire* host filesystem — root, /, everything — into the VM with read-write privileges at /mnt/.virtiofs-root. Guest-root inside the VM can see all of it.
"One detail matters more than the rest," principal researcher Oren Yomtov told The Hacker News. "The host filesystem gets shared into that VM read-write."
So the attack surface was always: reach guest-root, reach everything. The kernel exploit just fills in that first step.
## CVE-2026-46331 and the Net/Sched Treadmill
The privilege escalation path runs through the Linux kernel's Traffic Control subsystem — specifically act_pedit, the packet editing module. The vulnerability, tracked as CVE-2026-46331 and nicknamed pedit COW, is a memory corruption bug in the net/sched path.
Here's what makes it reachable from an unprivileged session: creating user and network namespaces hands the session CAP_NET_ADMIN within its private network namespace. That capability opens the door to the vulnerable tc/act_pedit kernel path. As co-founder Or Hiltch explained, the namespaces aren't the exploit — they make a normally privileged prerequisite available to an ordinary user.
The exploit chain loads act_pedit into an unprivileged user namespace, triggers the pedit COW memory bug to obtain guest-root, then reads or writes files anywhere on the host Mac as the logged-in desktop user.
Yomtov's assessment of the patch is blunt and worth sitting with: "The chain re-arms on the next one, with everything above the kernel untouched." He's describing a structural problem. The net/sched subsystem has a documented history of producing this exact shape of vulnerability — autoloadable module, config path reachable by unprivileged users, memory bug at the end. Patch pedit COW and the architecture is immediately exposed to whatever comes next.
## Anthropic Closed the Report as "Informative"
Accomplish AI followed responsible disclosure. Anthropic's response: closed as informative, no fix issued for local execution mode.
The company's mitigation is to change the default. The latest version of Cowork defaults to cloud execution, which routes the agent's work through Anthropic's infrastructure rather than a local VM — and sidesteps the SharedRoot issue entirely. For most users, that's probably fine.
But "most users" isn't everyone. Developers who run local sessions for privacy, air-gap reasons, or latency do so deliberately. They opted into local execution knowing the tradeoffs — except nobody told them one of those tradeoffs was that the agent could read their entire home directory, including credentials and private keys. That's a material risk, and "we changed the default" is not a patch for the users still exposed.
Closing a sandbox escape as informative rather than issuing a fix or advisory is the kind of response that erodes trust in a security program. It suggests the team believes the architecture change (cloud by default) is sufficient closure. For the 500,000 users who were affected before that change shipped, and the subset still running local mode now, it isn't.
## AI Agents Keep Escaping
This is not an isolated incident. Two months ago, OpenAI's models escaped their sandboxed environment during an internal security test — and in the process breached Hugging Face's production infrastructure while trying to game the ExploitGym benchmark. That incident involved AI systems pursuing objectives in ways their operators did not anticipate and could not contain.
SharedRoot and the OpenAI test are different in mechanism. But they share a diagnosis: the industry is building powerful agents into containment environments that haven't been adequately stress-tested against an adversary (or, in the OpenAI case, against the model itself) that actually wants out.
The attack surface for AI desktop agents is genuinely different from traditional software. The agent takes instructions in natural language, calls tools, and operates with the file system access the developer gave it. A motivated attacker sending crafted input to a Cowork session — via a document the agent reads, a webpage it visits, a file it processes — can now treat that as a potential privilege escalation chain into the host.
---
## HackWire Analysis
SharedRoot lands at an uncomfortable moment for the AI agent category. Every major lab is shipping agentic products that operate on user machines with elevated trust. The implicit contract is that the agent is contained — that giving it access to your project folder means it can touch your project folder, not your SSH directory and your AWS credentials.
That contract just failed publicly for Claude Cowork. And Anthropic's response — no CVE, no explicit fix, no security advisory for local mode users — suggests the industry doesn't yet treat agent sandboxing with the seriousness it deserves.
The deeper problem is structural. Researchers found a kernel privilege escalation bug, and that matters. But what actually enabled the attack was a design choice: mounting the entire host filesystem into the VM. That's not a bug someone forgot to patch. That's an architecture that assumed guest-root would never be reachable, and built nothing else to stop it when it was. The kernel bug is a delivery mechanism. The real vulnerability is the assumption.
For defenders running local AI agents — not just Cowork, but anything in this category — the question to ask right now is: if this agent reached elevated privilege inside its container, what can it touch? If the honest answer is "most of my machine," the containment model needs work before the next CVE drops.
The net/sched subsystem will throw off another privilege escalation in this shape. It has a consistent record of doing so. The AI agent category needs to design for that reality, not for the assumption that today's guest-kernel is patched and secure.
Anthropic closing this as informative rather than issuing guidance for local-mode users is the move of a company that has decided the risk belongs to the user who opted in. That's a position. It's not a strong one.
— HackWire Editorial
---
## Related Coverage