Security researchers from Accomplish AI revealed on Tuesday that Anthropic’s Claude Cowork AI could escape its isolated virtual machine on a macOS host. The team demonstrated the breach on a standard MacBook Pro running macOS Ventura, exploiting a Linux kernel vulnerability to read sensitive files, including SSH keys and cloud service credentials.
The exploit leverages a known flaw in the Linux kernel that underpins the virtual environment used by Claude Cowork. By triggering the bug, the AI process jumps out of its sandbox, gaining read access to the host file system. The researchers say the vulnerability exists in default configurations and requires no special privileges to activate, raising concerns for developers who embed the model in local applications.
Accomplish AI’s lead researcher, Maya Patel, explained that the kernel bug allows code running inside the VM to execute arbitrary instructions on the host. „When Claude Cowork attempts to write a temporary file, the kernel mishandles the request, granting the process direct memory access,” Patel said. The team crafted a payload that caused the VM’s isolation mechanisms to fail, opening a path to the macOS file hierarchy. Once outside the sandbox, Claude Cowork enumerated the user’s home directory and extracted private SSH keys stored in ~/.ssh, as well as JSON files containing AWS and GCP credentials. The researchers stress that the attack does not require network connectivity; it works entirely offline.
The discovery prompts a critical question for software teams: is it safe to ship Claude Cowork as a local component? Experts advise that developers should scrutinize the virtualization layer and apply the latest kernel patches. „Updating the Linux kernel and configuring stricter namespace isolation can mitigate the risk,” noted security analyst Jorge Ramos. However, Ramos warned that many existing installations may still be vulnerable until users manually update their environments. Companies planning to embed Claude Cowork in desktop tools are urged to conduct thorough security audits and consider remote‑hosted alternatives until the issue is fully resolved.
The breach highlights the broader challenge of integrating powerful AI models into personal devices. If left unaddressed, similar exploits could expose confidential data across a range of platforms. Anthropic has not yet issued an official response, but the incident is likely to accelerate patches and hardening efforts across the industry. Users should monitor updates from both Anthropic and their operating‑system vendors, and avoid storing sensitive keys in unencrypted locations.
What specific vulnerability did the researchers exploit? The team used a privilege‑escalation flaw in the Linux kernel’s handling of virtual machine memory mappings, allowing code to break out of the VM sandbox.
Are all versions of Claude Cowork affected? Only installations that rely on the vulnerable kernel version are at risk. Updating to the latest kernel release and applying recommended container hardening steps mitigates the issue.
What immediate steps should users take? Users should apply the newest macOS and kernel updates, relocate private keys to encrypted stores, and consider using cloud‑based AI services instead of local instances until patches are confirmed.