Roughly 500,000 Mac users were exposed by a design flaw in Anthropic’s Claude Cowork that allowed AI agents to break out of their sandboxed Linux VM and access files across the host system, according to researchers at Accomplish AI.
The vulnerability, named SharedRoot, exploited the way Claude Cowork’s virtualization layer handled file system mounts. The AI agent’s Linux environment was intended to be fully isolated from the Mac host, but a misconfiguration in the shared folder permissions allowed the agent to read and write files outside the sandbox.
Anthropic has since patched the issue, but the incident highlights the security challenges that arise when AI agents are given broad file system access in desktop applications. Sandbox escapes have been a recurring concern for AI coding assistants and agentic tools that run code on behalf of users.
The researchers recommend that users of AI development tools verify that their environments enforce strict VM isolation and regularly audit file system permissions granted to agentic AI software.
