SECURITY · AGENT SANDBOXING
On July 23, Accomplish AI researcher Oren Yomtov disclosed SharedRoot: a chain that escapes Claude Cowork's local Linux VM sandbox and reaches the full host Mac filesystem, SSH keys and cloud credentials included, using an unprivileged namespace, a kernel module autoload, and a memory-corruption CVE that never writes a byte to disk. Anthropic closed the report as "informative" and did not patch the underlying bug, but Cowork now defaults to cloud execution, which removes the filesystem mount the chain depends on. This is a small working demo of the six-step chain and what it actually reaches on a machine that runs client work.
The escape chain · SharedRoot, disclosed 23 July 2026
Six steps, no user interaction past the prompt that started the agent session. Click each one to see what actually happens at that step.
Unprivileged user namespaces are allowed by default in the guest VM's kernel config, so any session process can create one and become "root" inside it, plus CAP_NET_ADMIN, without touching anything privileged yet.
Blast radius calculator
Check what sits on the same Mac as a local agent session. This is not this specific bug (Anthropic moved Cowork to cloud execution by default after disclosure); it is the general shape of what any local VM escape reaches on a machine that runs client work.
4 of 6 categories reachable · exposure 11/14
Every checked item sits behind the same VirtioFS mount, one filesystem boundary, not per-folder isolation. A local VM escape that reaches guest-root reads all of it in one pass, not just the folder the agent was pointed at.
WHY THIS MATTERS FOR CLIENT WORK
I run agent sessions against client repos on the same machine that holds my own SSH keys and cloud credentials, the exact profile this bug targets. Nothing here is about distrusting one product; it is that a local sandbox is a filesystem boundary first and a trust boundary second, and the two are not the same thing until proven otherwise. The concrete habit this earns: check whether a local agent session shares one mount across everything on disk or isolates per-folder, prefer cloud execution when a bug like this is fresh, and never assume a VM label alone means a client repo can't see another client's files.
Built 25 July 2026 · disclosure by Oren Yomtov, Accomplish AI (2026)