Claude Cowork Sandbox Escape (VM-to-Host File Access)
First seen Jul 24, 2026 · Updated Jul 24, 2026
Researchers found a sandbox escape flaw in Anthropic's Claude Cowork that allows the AI agent (or something controlling it) to break out of its intended Linux VM isolation and read/write arbitrary files on the host Mac. This undermines the core security guarantee that the agent's actions are confined to the sandbox, exposing roughly 500,000 macOS users to potential host-level file access. This is a genuine isolation/architecture vulnerability rather than a prompt-injection-specific issue.
Technical Analysis
Claude Cowork executes agent tasks inside a Linux VM intended to isolate the agent's file operations and tool use from the host macOS system. The disclosed flaw allows a boundary crossing from the VM guest to the host filesystem, meaning file read/write operations issued by the agent (potentially influenced by malicious task instructions, documents, or compromised tool calls) can affect files outside the sandboxed environment. This crosses a critical trust boundary: the agent's tool/execution layer gains host-level filesystem privileges it was never meant to have, enabling data exfiltration, tampering, or persistence on the underlying Mac. The exact escape mechanism (e.g., shared mount misconfiguration, symlink handling, VM bridge/API flaw) is not detailed in the source, so the precise technical vector remains unconfirmed pending full disclosure.
Affected Systems
Claude Cowork
Detection Signatures
- Monitor Claude Cowork VM logs for filesystem writes/reads targeting paths outside the expected VM mount namespace
- Alert on unexpected access to host paths (e.g., /Users/, /Library/) from within the sandboxed VM process
- Watch for anomalous symlink creation or traversal patterns (../ sequences) in agent-initiated file operations
- Review VM-to-host shared folder/mount configurations for overly permissive bind mounts
Remediation Steps
- 1
Apply vendor patch
Update Claude Cowork to the patched version once Anthropic releases a fix addressing the sandbox escape.
- 2
Restrict shared mounts
Audit and minimize VM-to-host shared folder/mount permissions; ensure the agent VM cannot access host paths beyond an explicit allowlist.
- 3
Least-privilege host user
Run Claude Cowork under a restricted macOS user account with minimal filesystem permissions to limit blast radius if escape occurs.
- 4
Monitor and log
Enable detailed logging of agent file operations and VM boundary crossings; alert on any host filesystem access from the sandbox.
- 5
Network/file DLP controls
Deploy endpoint monitoring to detect unexpected exfiltration or modification of sensitive host files following agent task execution.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.