Executive Summary
Accomplish AI found a sandbox escape in Anthropic's Claude Cowork letting the agent break out of its Linux VM to read or write files anywhere on the Mac; about 500,000 macOS users were affected.
What Happened
Cybersecurity researchers have uncovered a sandbox escape vulnerability in Anthropic's Claude Cowork that makes it possible to break out of the confines of a Linux virtual machine (VM) within which the agent runs to read or write files anywhere on the Mac. Accomplish AI, which shared details of the vulnerability with The Hacker News ahead of publication, said about 500,000 macOS users running
Affected Products
- Anthropic Claude Cowork
Vulnerability / Attack Technique
VM sandbox escape
Technical Mechanism
The agent could escape the Linux VM it runs in and access the host macOS file system.
AI Security Category
LLM06:2025 Excessive Agency
Part of the AI Agent Excessive Agency topic.
Relevant Frameworks
RealGround Analysis
The VM was the main safety boundary. RealGround analysis: assume desktop agent sandboxes can fail and keep sensitive files separated.
Recommended Controls
- Update Claude Cowork
- Keep sensitive files off machines running desktop agents
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/07/claude-cowork-flaw-could-let-ai-agent.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.