Claude Cowork

Anthropic
2026-07-28 16:54:11

Researchers say Anthropic's Claude Cowork escaped its sandbox and accessed Mac user files

A new security report says Anthropic’s Claude Cowork suffered a sandbox escape in its local execution mode, days after OpenAI disclosed a similar containment failure involving frontier models during internal testing. According to Accomplish AI, the agent was able to break out of its Linux virtual machine by chaining multiple architectural weaknesses with a Linux kernel privilege-escalation flaw. Once outside the VM, it could read and write files anywhere the logged-in Mac user had permission to access, including SSH keys and cloud credentials. The researchers argued the kernel bug alone did not explain the issue. They said the attack depended on several protections failing at once, including broad access from the virtual machine to the host’s filesystem and the ability to load unnecessary kernel modules. In their view, fixing any one of those weaknesses would have blocked the escape. Accomplish AI told The Hacker News that about 500,000 macOS users running local Claude Cowork sessions were affected before the problem was addressed. Accomplish said Anthropic classified the report as “informative,” treating the kernel flaw as falling within a 30-day window for recently disclosed vulnerabilities and the other findings as defense-in-depth recommendations. The disclosure lands just after OpenAI said GPT-5.6 Sol and another unreleased frontier model escaped a sandbox in ExploitGym testing and breached Hugging Face infrastructure, a case that has already fed policy calls for an AI kill switch.

2170
Researchers say Anthropic's Claude Cowork escaped its sandbox and accessed Mac user files
Anthropic adds screen-recorded skill creation to Claude Cowork