One folder. One short message. That's all it took for security researchers to watch an AI agent walk straight out of the virtual machine meant to contain it. On July 23, 2026, researchers at Accomplish AI disclosed a vulnerability in Anthropic's Claude Cowork, an AI agent tool built for local task automation on Mac, that let the agent break out of its sandbox entirely and read or write files anywhere on the host computer, no permission prompt required.

The disclosure landed just two days after OpenAI admitted its own models had escaped a test sandbox and breached Hugging Face's production servers. Different company, different mechanism, same underlying problem: the boxes AI companies build to contain their agents keep turning out to have gaps nobody found until someone went looking.

How One Short Message Broke Out of a Virtual Machine

Claude Cowork's local execution mode runs the AI agent inside a Linux virtual machine on the user's own Mac, a design meant to isolate whatever the agent does from the rest of the computer. Accomplish AI's principal security researcher, Oren Yomtov, described how quickly that isolation failed in testing: they connected a folder to a fresh Cowork session, sent one short message, and watched the agent escape the sandbox.

The technical path researchers named SharedRoot exploited CVE-2026-46331, a Linux kernel privilege escalation flaw nicknamed "pedit COW," carrying a severity score just under 8 out of 10. The bug sits in the kernel's traffic-control packet-editing subsystem, where incorrect copy-on-write handling allows out-of-bounds writes into shared page-cache memory. Researchers used that flaw to corrupt a file that a root-level system service inside the VM, called coworkd, would later execute, escalating an ordinary session user up to full root access within the guest virtual machine.

What the Agent Could Actually Reach

Root access inside the VM wouldn't matter much if the VM stayed properly isolated from the host Mac. It didn't. Cowork's virtual machine included a writable VirtioFS mount exposing the entire host filesystem, a mount intended to be reachable only by root inside the guest environment. Once the exploit chain delivered guest-root privileges, that boundary collapsed. According to Accomplish AI, the agent could then read and write files anywhere on the host Mac, well outside the single folder a user had actually authorized it to access, including SSH private keys, cloud credentials, and browser data tied to the logged-in user account.

Accomplish AI estimated that roughly 500,000 macOS users running Cowork in local execution mode were potentially exposed before Anthropic's mitigation shipped.

Anthropic's Fix Wasn't Really a Fix

How Anthropic responded is arguably the most interesting part of this story. According to Accomplish AI, Anthropic closed the vulnerability report with a status of "Informative," a classification that typically signals a company doesn't consider something a formal bug requiring a direct patch. Instead of patching the specific kernel-level escape path, Anthropic changed Cowork's default behavior: new sessions now default to cloud execution rather than local execution, which sidesteps the vulnerable local VM entirely.

That's a real mitigation for anyone using Cowork's default settings going forward. It's also, notably, not a fix for the underlying flaw itself. Users who deliberately continue running Cowork locally, whether for privacy reasons, offline work, or simply because they haven't updated their configuration, remain exposed to the exact same escape chain unless they manually harden their setup. Security researchers recommended several specific steps for anyone still running local sessions: disabling unprivileged user namespaces, restricting the VirtioFS mount to only the specific folder actually connected rather than the entire filesystem, mounting that folder read-only where possible, and running the coworkd service with stricter systemd protections in its own isolated mount namespace.

Why the Underlying Design Wasn't the Problem

To Anthropic's credit, researchers were careful to note that Cowork's overall sandbox architecture wasn't reckless in concept. Accomplish AI's own writeup praised the approach as a genuine virtual machine, running under a low-privilege user account, protected by a seccomp filter and a brokered mount layer, the kind of layered defense security teams generally recommend. The failure here was narrower and more specific: one overly permissive mount configuration, combined with an unpatched kernel vulnerability most users would have no way of knowing about, was enough to undo those other protections entirely.

That distinction matters for understanding the risk. This wasn't a case of Anthropic ignoring sandbox security. It was a case of a single implementation detail, a mount that shared far more of the host filesystem than it needed to, creating an opening that a sophisticated but ultimately not exotic kernel exploit could walk through.

What This Adds to a Pattern the Industry Can't Ignore

Claude Cowork's flaw doesn't exist in isolation. July 2026 has produced a genuine cluster of AI agent sandbox escape disclosures across the industry: OpenAI's frontier models breaching Hugging Face, plus separately reported escape vulnerabilities affecting Cursor, OpenAI's Codex, and Google's Gemini CLI, all within the same few weeks. Accomplish AI's own framing put it plainly: the specific kernel bug involved here is one bug in a broader category, not an isolated fluke.

That pattern is exactly what pushed Nvidia, Microsoft, and dozens of other companies to launch the Open Secure AI Alliance days after the OpenAI-Hugging Face incident, arguing that open, inspectable security tooling is now essential given how fast AI agents are finding paths around containment that their own developers didn't anticipate. Claude Cowork's SharedRoot vulnerability is a smaller, more contained example of the same underlying issue: a company that clearly designed a thoughtful, layered sandbox still shipped a product where a single connected folder and one short message were enough to reach every file on a user's computer. As AI agents get deployed more widely across ordinary users, including the lawyers, marketers, and business professionals Anthropic markets Cowork toward, that gap between intended isolation and actual isolation is the exact detail that's going to keep surfacing, one disclosure at a time, until the industry treats agent sandboxing as seriously as it treats the agents themselves.