SharedRoot: Sandbox Escape in Claude Cowork

SharedRoot is the name researchers gave to a sandbox-escape chain affecting the local execution mode of Claude Cowork on macOS. The chain uses CVE-2026-46331, a Linux kernel flaw, to move from code execution inside Cowork’s Linux virtual machine to access to files on the host Mac.

A successful attack could expose or modify files accessible to the logged-in macOS user, including credentials and private data.

This article covers the vulnerability identity, affected deployments, exploitability, impact, detection guidance, and mitigations.

What Is SharedRoot?

SharedRoot is not currently identified as a separate CVE. It functions as an attack chain, which combines CVE-2026-46331 with the local Claude Cowork VM and its host-filesystem sharing design.

CVE-2026-46331 affects Linux traffic-control code in the act_pedit component. In plain language, the kernel could calculate a copy-on-write range before it knew the full region that would be modified. Under certain conditions, a write could therefore affect shared page-cache data instead of first creating a private copy.

Ubuntu assigns the CVE a High priority and a CVSS score of 6.7, rated Medium. The Linux kernel CNA lists a CVSS score of 7.8, rated High, while Red Hat provides a supplemental score of 6.7 Medium. These differences reflect different assumptions about attack prerequisites.

Which Claude Cowork Versions Are Affected?

Researchers do not identify exact Claude Desktop or Cowork application versions affected by SharedRoot. The scope is architectural rather than tied to a published application-version range.

Anthropic documents local Cowork execution on macOS and Windows through a dedicated Linux VM, while the SharedRoot demonstration specifically targeted a macOS host using Apple’s Virtualization framework. The researchers did not establish whether the same chain works against Windows local deployments.

For CVE-2026-46331, Ubuntu’s advisory listed multiple kernel branches as vulnerable or work in progress when it was last updated on July 21, 2026. Organizations should validate the exact guest kernel and Cowork deployment against current vendor guidance rather than relying on the application version alone.

What Component Is Vulnerable, and Why Does It Matter?

The immediate vulnerable component is Linux’s traffic-control act_pedit module. The chain reached that kernel functionality from an unprivileged Cowork session through permitted namespace and netlink operations.

The Cowork architecture added several relevant trust-boundary conditions. According to the researchers, a session user could create a user namespace, obtain capabilities including CAP_NET_ADMIN within that namespace, and reach the vulnerable traffic-control path. A privileged coworkd daemon and shared filesystem objects then helped turn the kernel flaw into a guest-root transition.

The reported host impact depended on more than the kernel CVE. After obtaining root in the guest, the researchers said they could access a writable mount at /mnt/.virtiofs-root that represented the host filesystem. This broad mount reportedly allowed access beyond the folder explicitly connected to Cowork.

How Could SharedRoot Be Exploited in Practice?

The exploit chain begins with code running inside a local Cowork session. That initial code could come from agent activity involving untrusted content, such as documents or prompt-injection material, but the reviewed sources do not establish a single required delivery method.

At a high level, the sequence is:

• Code runs as an unprivileged session user inside the Linux VM.
• The session reaches permitted namespace and netlink functionality.
• Linux loads or exposes the vulnerable act_pedit path.
• CVE-2026-46331 enables corruption of shared page-cache data under specific conditions.
• A privileged helper that shares relevant filesystem objects re-executes altered data, reportedly producing guest-root access.
• Guest root accesses the writable host-filesystem mount and can operate on files available to the logged-in macOS account.

This sequence depends on multiple conditions. Local Cowork mode must be in use, the guest must contain a vulnerable kernel, the relevant kernel and namespace paths must remain reachable, and the host-sharing design must expose writable filesystem content. It is not a general compromise of Claude.

Is There Active Exploitation of SharedRoot?

Unclear, with no confirmed in-the-wild exploitation. Accomplish researchers reported a successful test on their own Mac and publicly described the chain on July 23, 2026. That confirms claimed exploitability in at least one tested configuration, but it does not establish use by threat actors.

In the technical disclosure, researchers noted that Anthropic classified their submission as “Informative,” and characterized their additional hardening recommendations as defense-in-depth measures.

Proof-of-Concept for the SharedRoot Exploit Chain

Defenders can review the end-to-end demonstration for SharedRoot in the Accomplish research blog. A separate public proof of concept (PoC) for CVE-2026-46331 is also available on GitHub.

SOCRadar’s Cyber Threat Intelligence and Attack Surface Management (ASM) can help your security team track vulnerability updates, including for CVE-2026-46331, and compare exposure across systems that support local Cowork use, allowing you to prioritize deployments with sensitive host data.

Teams should correlate vulnerability intelligence with endpoint telemetry and evidence of unusual Cowork-related file activity, rather than treating the public PoC as proof of compromise.

What Should Defenders Do Now?

Patch and Reduce Exposure

• Apply available vendor kernel fixes to Cowork’s local VM. Confirm the running guest kernel rather than checking only the Claude Desktop application version.
• Prefer Cowork’s cloud execution mode. Anthropic describes remote sessions as temporary, server-side sandboxes, and the researchers reported that the local VM escape path did not appear to apply to that model.
• Avoid using local Cowork with sensitive files, SSH keys, cloud credentials, or broad home-directory access until clear remediation guidance is available.
• If a vulnerable local session may have accessed host files, rotate or invalidate credentials that could have been exposed.

Apply Compensating Controls

Where patching or deployment changes are not immediately possible, apply controls that reduce the chain’s reachable surface:

• Restrict or disable unprivileged user namespaces in the guest where compatible with Cowork operations.
• Use a restrictive seccomp policy that blocks unnecessary namespace creation and netlink access.
• Prevent autoloading of unused kernel modules, including relevant traffic-control modules.
• Ensure privileged helper processes cannot be influenced through shared filesystem objects.
• Replace whole-host writable mounts with narrowly scoped mounts containing only explicitly connected folders. Prefer read-only or brokered access where supported.

The broad host mount represents the most consequential architectural condition in the reported chain. If guest root can see only a restricted, non-sensitive directory, the potential impact is lower than when it can write across the host filesystem.

Detect and Hunt for Behavior

• Monitor host filesystem telemetry for unexpected file creation or modification outside Cowork-connected directories during or shortly after local sessions.
• Review changes to SSH key locations, cloud-credential directories, shell startup files, browser profiles, launch agents, and other user-accessible locations.
• Examine macOS process and audit telemetry for unexpected writes associated with Claude Desktop or Cowork-related processes.
• If VM telemetry is available, investigate unexpected namespace creation, traffic-control configuration, act_pedit module loading, privileged helper re-execution, and transitions from the session user to guest root.
• Account for visibility gaps. Anthropic states that host EDR tools cannot inspect activity inside the isolated local VM by design, so detection should combine host-file monitoring with application, VM-image, and kernel telemetry where available.

No confirmed public IOC set for SharedRoot was identified. Behavioral anomalies are therefore more useful than hash-based detection at this stage.

Organizations should prioritize a focused, risk-based response by securing local Cowork deployments, rather than treating this as a widespread remote exploit.