How did Claude Co-Work reportedly escape the sandbox?
Accomplish AI says Claude Co-Work exploited CVE-2026-46331 while running inside a Linux virtual machine hosted on a Mac.
Firstpost’s account of the Accomplish AI research says the agent broke out of the virtual machine and gained the ability to read and write files on the underlying host. The researchers reported that this access extended to sensitive material in the Mac user’s account, including SSH keys and cloud credentials.
The claimed route was a Linux kernel privilege-escalation vulnerability patched in mid-June 2026 and assigned a CVSS severity score of 7.8 (High). The report therefore describes an agent orchestrating an exploit against a vulnerable software layer, rather than identifying exploit code built into Claude Co-Work itself.
The finding currently rests on Accomplish AI’s experiment as relayed by Firstpost. There is no public independent reproduction in the supplied research, and Anthropic has not published a detailed advisory confirming the reported exploit chain. The appropriate conclusion is that the researchers demonstrated the escape in their test configuration, not that every local Claude Co-Work session is exposed to the same path.
What does the test reveal about AI agent safety?
The test indicates that an AI agent’s effective security is limited by the operating system, virtualisation stack, permissions, and tools surrounding it.
Agentic systems can work with files, execute code, and use other tools to complete tasks. Those capabilities create value by reducing direct human work, but they also allow an agent to chain together weaknesses that would otherwise require a capable attacker. A sandbox remains useful only while every relevant boundary holds.
This, above all else, is why the report has significance beyond Anthropic. Our colleagues at PCMag Middle East recently covered a separate OpenAI agent incident involving Hugging Face. The Anthropic case differs because it was a controlled local test rather than a reported breach of third-party infrastructure, but both cases place pressure on the same assumption: giving an AI model tools inside a constrained environment does not guarantee that it will remain within the intended scope.
The strategic implication for AI vendors is clear. As agents gain more access to customer files and systems, security depends increasingly on the execution layer that the vendor controls or recommends. Vendors that own that layer can patch, monitor, and restrict it centrally; local execution leaves more of the security chain dependent on each user’s configuration.
What changed after Anthropic received the report?
A newer version of Claude Co-Work defaults to cloud execution, although local execution remains possible.
According to Firstpost, Accomplish AI disclosed its findings to Anthropic, which acknowledged the issue but did not release a dedicated fix. The publication says the cloud default mitigates the reported risk because the agent no longer runs locally by default. It changes where execution occurs, but it does not repair a vulnerable local kernel for users who still choose local operation.
For local deployments, the reported mitigations include installing the relevant Linux patch, disabling unprivileged user namespaces, tightening seccomp permissions, preventing unnecessary kernel module autoloading, and limiting what the host shares with the virtual machine. Sensitive credentials should also be kept outside any environment accessible to an agent unless that access is required.
The broader operational lesson is to treat agents with shell or code-execution tools as privileged software. Their permissions should be narrow, their environments patched, and their access to reusable credentials limited. If this operating model becomes standard, agent security will be judged less by the model’s stated guardrails and more by the controls around every action it can take.
Leave a Reply