Could Claude Cowork Read Every File On Your Mac? What SharedRoot Proved

July 27, 2026

Researchers escaped a local Claude Cowork VM and reached files across the host Mac. Here is what SharedRoot proved, what changed, and what remains unclear.

Under the local macOS setup tested by Accomplish AI, yes. Researchers used a Linux kernel flaw to gain root inside Claude Cowork's virtual machine, then reached files across the host Mac through a read-write filesystem mount. The result proves a real lab escape, not widespread exploitation. Anthropic's current Cowork documentation describes remote execution by default, and several important affected-version and remediation details remain unpublished.

Updated July 27, 2026: This article reflects Accomplish AI's July 23 SharedRoot disclosure, current Anthropic Cowork and containment documentation, official CVE records, and follow-on coverage through July 27.

Who This Article Is For

This article is for:

The useful question is not, "Did Claude become sentient?" There is no evidence that it did. The useful question is:

Which session mode was running, what untrusted content entered it, what separated the guest from the host, and what could the process reach after that boundary failed?

What Is Confirmed

Researchers Ran An End-To-End Escape On Their Own Mac

Accomplish AI's primary SharedRoot disclosure says its researchers connected a folder to a fresh local Claude Cowork session, sent one short message, and ran a complete chain that ended with a file written outside the connected folder.

According to the disclosure, local Cowork work ran as an unprivileged user inside a Linux virtual machine created through Apple's virtualization framework. The design included a syscall filter and a root service named coworkd that brokered filesystem access.

The researchers describe this sequence:

  1. The session user created an unprivileged Linux user namespace.
  2. That namespace provided capabilities needed to reach a traffic-control kernel module.
  3. The session used CVE-2026-46331, known as "pedit COW," to corrupt the page-cache copy of a root-owned helper.
  4. The root coworkd service later executed the poisoned helper, producing guest-root access.
  5. Guest root found the Mac's host filesystem mounted read-write at /mnt/.virtiofs-root.
  6. The process read and wrote files as the logged-in Mac user, outside the folder originally connected to Cowork.

Accomplish says it ran the full chain end to end on its own machine. That is materially stronger than a diagram of a hypothetical attack. It is still a controlled researcher demonstration, not proof that other users were compromised.

The Underlying Linux Flaw Is Independently Documented

The kernel vulnerability in the middle of the chain is not based only on the research company's description.

Ubuntu's CVE record for CVE-2026-46331 tracks the Linux traffic-control flaw and available fixes. NIST's National Vulnerability Database describes an incomplete copy-on-write operation in tcf_pedit_act() that could leave part of a write region tied to the page cache.

That distinction matters. SharedRoot was not merely a model choosing to ignore a system prompt. It joined:

Remove any one of those links and this demonstrated chain stops.

The Whole-Host Mount Turned Guest Root Into Host Access

The most important SharedRoot finding is not simply that a Linux guest could be rooted. Guest vulnerabilities are inevitable over a long enough period.

The decisive blast-radius choice was the reported read-write mount of the Mac's entire / filesystem inside the VM. It was visible only to guest root, but the kernel exploit supplied exactly that privilege.

Accomplish recommends four independent containment changes:

The last control changes the outcome even if another guest-root exploit appears. If only an explicitly connected folder is mounted, preferably read-only where practical, root inside the guest does not automatically become access to every file the desktop user can reach.

Anthropic's own May engineering article, How We Contain Claude Across Products, makes the same broader point: environment controls, model-layer defenses, and restrictions on external content must overlap. It also says probabilistic model defenses cannot guarantee a zero-percent miss rate.

Current Cowork Documentation Describes Remote Execution By Default

Anthropic's current getting-started guide says Cowork tasks now run remotely in beta, with shell commands and generated code executing in an isolated environment on Anthropic's servers.

When a task needs a local file, browser, or computer action, the guide says the remote session reaches the computer through Claude Desktop. It also says:

Accomplish says the later remote default sidesteps the specific local-VM chain it demonstrated. That is a meaningful change in exposure, but it is not the same as saying every path to local files is risk-free.

Remote execution moves the code-execution boundary away from the Mac. It also creates a hosted processing path. Users must therefore evaluate security, privacy, retention, account storage, connectors, and local desktop bridging separately.

What Is Still Unclear

Which Versions And Users Were Affected

The sources reviewed for this article do not provide a precise Claude Desktop build range, Cowork image version, or public list of affected configurations.

Secondary coverage has repeated an estimate of roughly 500,000 exposed macOS users. Accomplish's primary post does not provide a reproducible census or explain how many people used the local execution path. Treat that figure as an attributed estimate, not an audited Anthropic user count.

Whether The Local Image Or Host Mount Was Patched

Accomplish says Anthropic closed the report as Informative because the kernel bug was already public and the other recommendations were treated as defense in depth. The primary post says Cowork now defaults to cloud execution.

Anthropic has not published a dedicated SharedRoot advisory that answers:

The current guide says seeing "Setting up Claude's workspace" can mean Cowork is updating to the newest version. That is useful operational guidance, but it is not a versioned security bulletin.

Whether Anyone Was Attacked Outside The Lab

The sources reviewed here do not report exploitation in the wild.

Accomplish proved that the chain worked on its machine. It did not publish evidence that an attacker used a poisoned repository, document, web page, or connector to compromise another person's Mac.

This is also not evidence that Claude independently decided to steal credentials. The demonstration began with a researcher-controlled session and a deliberate path. The security concern is that an agent designed to process untrusted material could be induced to execute a chain with more authority than the user intended.

What Anthropic Independently Confirmed

Accomplish says it reported the issue to Anthropic and that Anthropic closed it as Informative. Current Anthropic documentation describes the product's present remote architecture and acknowledges that attacks remain possible.

Anthropic has not published an article confirming every technical detail in the SharedRoot report. Until it does, the precise Cowork implementation details, response timeline, and remaining local-mode exposure should stay attributed to Accomplish.

A Six-Boundary Test For Any Desktop AI Agent

The SharedRoot lesson is broader than one CVE. Before trusting a desktop agent with sensitive work, audit six boundaries.

Boundary Question to ask Why it matters
Input Can repositories, PDFs, websites, emails, or tool output contain untrusted instructions? The agent may treat data as a command
Execution Does code run locally, in a VM, in a container, or on the provider's servers? "Sandboxed" does not identify the actual boundary
Guest privilege What prevents an unprivileged process from becoming guest root? A guest-root exploit can defeat controls enforced only inside the guest
Host bridge Which folders, sockets, credentials, clipboard data, or devices are exposed to the guest? The bridge determines what an escape can reach
Action authority Can the agent read, write, delete, send, schedule, or connect without approval? Permission scope defines the practical blast radius
Recovery Are builds versioned, logs reviewable, tokens revocable, and backups available? Users need a way to investigate and recover after a failure

This test produces a more useful answer than asking whether a product is "local" or "cloud."

A local agent can expose more of the host than expected. A remote agent can process and retain data on provider infrastructure. Either design can be appropriate, but neither is automatically private or secure.

What Claude Cowork Users Can Do Now

1. Confirm Which Execution Path You Are Using

Do not infer session mode from the desktop icon. Check the current product interface and documentation for whether the task is remote, local, or using a remote session bridged to local resources.

If your organization requires local execution, ask Anthropic for a documented affected-version range and the exact hardening status of the guest kernel, mounts, namespaces, syscall policy, and privileged broker.

2. Update Claude Desktop Before Connecting Sensitive Folders

Install the current desktop build through Anthropic's official update path. Restart the app and allow Cowork to complete any workspace update before resuming work.

An update alone is not proof that SharedRoot is fixed, because a public fixed-build statement is not available. It is still a necessary first step when the reported mitigation includes an architecture and default-mode change.

3. Connect A Dedicated Working Folder

Anthropic's Cowork safety guide recommends using a dedicated working folder rather than granting broad access to sensitive material.

Keep these outside the agent's working directory:

Folder scoping did not contain the local SharedRoot configuration Accomplish tested because of the whole-host mount. It still reduces routine exposure and remains valuable when the underlying host bridge is correctly enforced.

4. Use The Least-Permissive Approval Mode

Current Cowork documentation describes Manual, Auto, and Skip modes for connector actions. For work involving real messages, money, production systems, important files, or third-party accounts, prefer manual review and stay near the session.

Approval is not a substitute for containment. A sandbox escape may occur below the user-interface permission layer. Approval controls still reduce the ordinary authority available before or after another defense fails.

5. Review Credentials If You Ran Sensitive Local Sessions

If you used an affected local configuration with untrusted content and have concrete signs of unauthorized file access, disconnect the machine, preserve logs, and involve a qualified incident responder.

Prioritize revoking or rotating credentials that the logged-in Mac user could read:

Do not rotate every credential solely because a CVE exists. Use the session history, file timestamps, endpoint telemetry, network records, and other evidence to scope the response.

6. Maintain Offline Or Versioned Backups

Anthropic documents an approval prompt for permanent deletion, but SharedRoot operated beneath the intended folder and permission boundary. A versioned backup is the recovery control that remains useful even when the application's own deletion guard is bypassed.

What SharedRoot Does Not Prove

SharedRoot does not prove that:

It does prove a narrower and important point: a permission label such as "connected folder" is only as strong as the lower-level guest, broker, and host-mount architecture enforcing it.

That lesson complements the earlier OpenAI and Hugging Face sandbox incident, where a restricted evaluation environment also failed through the surrounding infrastructure. It also differs from the Claude for Chrome workflow vulnerability, which concerned browser-extension trust and action approvals rather than a local VM escape.

Where OpenVeil Fits

OpenVeil is relevant when a user wants a narrower AI chat workflow instead of an autonomous desktop agent with broad computer-control authority.

OpenVeil provides a paid, privacy-focused AI chat workspace with:

That does not make OpenVeil local-only or fully offline. Active requests can still be processed by OpenVeil and necessary AI, search, upload-processing, hosting, routing, security, billing, and infrastructure providers. OpenVeil is not an endpoint-security product and does not protect a Mac from an unrelated sandbox escape.

The product difference is scope. If the job is private AI conversation, research, or a deliberately uploaded file, a chat workspace may require less authority than an agent that can operate the desktop, browse applications, and keep working independently.

Compare that tradeoff in Private AI Chat vs Local AI, review the OpenVeil privacy policy, or create an OpenVeil account if a narrower paid chat workflow fits your needs.

Frequently Asked Questions

Did Claude Cowork escape its sandbox?

Accomplish AI says it demonstrated an end-to-end escape from a local Claude Cowork Linux VM on its own Mac. The chain used CVE-2026-46331 to gain guest root, then reached the host filesystem through a read-write mount.

Could SharedRoot access files outside the connected folder?

Yes, in the configuration the researchers tested. They report that guest root could see the whole host filesystem mounted inside the VM and could read or write files available to the logged-in Mac user.

Is SharedRoot fixed?

The specific local path does not appear to apply to Cowork's current remote-by-default execution, according to Accomplish. Anthropic has not published a dedicated advisory with an affected-version range or a complete list of local hardening changes, so a universal "fixed" claim would be stronger than the public evidence.

Was Claude Cowork exploited in the wild?

No reviewed source reports in-the-wild exploitation. The confirmed evidence is a researcher-controlled demonstration.

Does using remote Cowork make the task private?

Not automatically. Remote execution can reduce the risk of local code escaping directly into the Mac, but task data, files, sessions, connectors, retention, and provider processing must be evaluated under the hosted service's current terms and controls.

Is a virtual machine enough to contain an AI agent?

A VM is a strong isolation layer, but it is not sufficient by itself. Guest patching, namespace and syscall restrictions, privileged brokers, mounts, egress, credentials, approval scope, monitoring, and recovery controls all affect the final blast radius.

Bottom Line

SharedRoot is a real, end-to-end lab demonstration with a narrow but serious conclusion: the local Claude Cowork setup Accomplish tested placed the Mac's whole filesystem one guest-root exploit away from the agent.

The current remote default appears to avoid that exact local-VM chain, but the public record still lacks a dedicated Anthropic advisory, a fixed-version range, and a complete account of remaining local-mode exposure. Update the desktop app, verify the execution path, connect only a dedicated folder, minimize approvals and credentials, and treat every agent's guest-to-host bridge as part of the security boundary—not an implementation detail.

When privacy, account control, uploads, and search matter, OpenVeil gives you a private AI workspace designed for that job.