MacSouverain

FREN
radar

Claude Cowork in local mode, the agent walks out of the sandbox

On macOS in local mode, Claude Cowork mounts your entire disk inside the agent's VM. One connected folder, one message, and it walks out without asking.

What Cowork actually mounts


In local execution mode on macOS, Claude Cowork mounts your Mac’s entire filesystem read-write inside the Linux virtual machine where the agent runs, at a mount point named /mnt/.virtiofs-root, visible only to the guest-root account. The whole disk. Not the folder you connected. The sandbox is a box, it just has no walls. The research, named SharedRoot, comes from Oren Yomtov, Principal Security Researcher at Accomplish AI, published on July 23, 2026 and picked up the same day by The Hacker News.


Anthropic’s documentation, however, states for local mode that file access is “limited to folders the member has connected”. That is the promise. The mount itself exposes the entire host.


The escape unfolds in one go. The agent starts as an unprivileged session user, grants itself root inside a user namespace, then has the kernel autoload a module from the Traffic Control subsystem that carries CVE-2026-46331, known as pedit COW: merely referencing it is enough to load it. The flaw is rated 7.8 on CVSS 3.1 by kernel.org on its NVD entry, 6.7 by Red Hat, with a public exploit, PACKET_EDIT_MEME.c, available since June 17. Page cache corruption poisons a cached binary, which the coworkd daemon then re-executes as root. By the end of the chain, guest-root has the host’s entire disk in hand.


The Hacker News claims roughly 500,000 macOS users in local sessions, a ballpark figure that no published methodology supports and that the researchers’ post does not repeat. Keep the scale, not the number. What is certain is that no permission prompt appears at any point in the chain.


On the fix, precision matters, because this subject invites shortcuts. Anthropic closed the report as “informative”, with no dedicated fix. At the same time, Cowork moved to cloud execution by default: Anthropic publishes no version number for Cowork, but dates the change to July 7, 2026 and describes it as a beta rolling out gradually, starting with the Max plan. The researchers note that the local escape path “does not appear to apply” on the cloud side, without having audited it. The mitigation is real. It fixes nothing for those running locally, and it has not reached everyone yet.


The VM looks like a wall


The point holds well beyond this one flaw: an agent’s sandbox is not a security boundary if it mounts the whole disk. The virtual machine gives the impression of isolation, the mount quietly voids it. Between the folder you think you are sharing and your entire user account, there is a gap that nothing in the interface flags.


Read next: AI Agents on Mac: ANSSI flags Claude Cowork and OpenClaw


The chain assumes the agent is already executing hostile code. Except that is its job: ingesting content you do not control, web page, PDF, ticket, then acting on it. On this kind of tool, prompt injection is no laboratory hypothesis. It is the main entry point.


Read next: Hugging Face compromised, and your local model?


The researchers recommend four hardening measures, and point out that each one, on its own, is enough to break the chain. Only one addresses the root cause though: mounting nothing but the folders actually connected. The other three remove a step from that particular staircase, the fourth removes the staircase.


The flaw is not isolated, it is a whole class of flaw. A model escaping its test sandbox, an agent protocol exposing code execution, now an agent handed the entire disk. The common thread is never the bug, it is the generosity of the perimeter granted by default.


Read next: Anthropic’s MCP, A design flaw exposes 200,000 instances to remote code execution


What you do now


1. Check your Claude Cowork execution mode. Cloud has become the default, but in beta and in waves since July 7: do not assume your account received it, go read it in the settings. If you are running locally, deliberately or by inheriting an old setting, you are affected.


2. Never run a local session from a macOS account that hosts your Keychain, your SSH keys or your password manager file. A dedicated user account for the agent, empty of secrets, costs five minutes and removes any value from the escape.


3. Treat everything the agent ingests as hostile code. A web page, an attachment, a client ticket: that is the entry point, and it is not filtered. You would not run that content through a script without looking, so do not feed it to an agent that has write access.


Sources