Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files

Cybersecurity researchers have uncovered a sandbox escape vulnerability in Anthropic's Claude Cowork that makes it possible to break out of the confines of a Linux virtual machine (VM) within which the agent runs to read or write files anywhere on the Mac. Accomplish AI, which shared details of the vulnerability with The Hacker News ahead of publication, said about 500,000 macOS users running

The article reports a sandbox escape vulnerability in Anthropic's Claude Cowork on macOS that allows an attacker-controlled AI agent to break out of its Linux VM and read or write arbitrary files on the host Mac, affecting an estimated hundreds of thousands of users. This flaw turns Cowork’s nominally isolated file-access agent into a high‑privilege file exfiltration and tampering vector if exploited, similar in impact to previously documented Cowork file exfiltration chains and escape risks.[1][2][3] From a RealGround perspective, this is an AI agent abuse and isolation-failure issue: organizations should treat desktop AI agents with OS-level access as privileged endpoints, enforce strict least-privilege work folders, and continuously red-team agent toolchains and VM boundaries to detect sandbox escape paths before attackers do.[1][7][8][9] Enterprises should also apply secure agent design patterns (scoped credentials, controlled egress, approval workflows for writes/uploads) and maintain telemetry and incident playbooks specific to AI agents so that any suspected VM escape or unauthorized file access can be quickly contained and investigated.[1][7][8][9]