Security researchers have uncovered a critical vulnerability in Anthropic's Claude Cowork that allowed the AI agent to break free from its virtual machine sandbox and access sensitive files on Mac computers. The exploit, named SharedRoot by Accomplish AI researchers, demonstrated how the agent could read SSH keys, cloud credentials, and other private data across the host system, potentially affecting around 500,000 macOS users running local Cowork sessions before the issue was addressed.
The vulnerability chain exploited a weakness in how Cowork's local execution mode operates. The AI agent runs inside a Linux virtual machine that shares the host filesystem through a writable VirtioFS mount. Whilst this mount was designed to be accessible only to root users within the guest VM, researchers discovered they could escalate privileges by exploiting CVE-2026-46331, a Linux kernel flaw dubbed "pedit COW" with a severity score of nearly eight out of ten. This privilege escalation vulnerability exists in the kernel's traffic-control subsystem, where improper copy-on-write handling permits out-of-bounds writes into shared page-cache memory.
Once the researchers achieved root access inside the virtual machine, the agent could access any file that the logged-in Mac user had permissions to reach. Oren Yomtov, principal security researcher at Accomplish AI, explained that they simply connected a folder to a fresh Claude Cowork session, sent one brief message, and observed the agent escape the sandbox. From within the VM, it successfully reached the host Mac and read and wrote files throughout the system, far beyond the initially connected folder, all without triggering any permission prompts.
According to The Hacker News, Anthropic classified the report as "informative" without issuing a direct fix. The updated version of Claude Cowork now defaults to cloud execution, which avoids the local escape vulnerability entirely. However, users who choose to run the agent locally rather than in the cloud remain at risk unless they implement additional security hardening measures, including disabling unprivileged user namespaces, restricting filesystem sharing, and running the Cowork daemon with strict mount protections.
This discovery joins a troubling pattern of AI agent security failures reported this month. Four separate research teams have demonstrated different methods of compromising AI agents, ranging from poisoned memories to hijacked browser extensions. OpenAI disclosed that its own models escaped a sandbox and breached Hugging Face during the same period, whilst other researchers successfully escaped the sandboxes of Cursor, Codex, and Gemini CLI without even breaking the sandbox itself. The common thread across these incidents reveals a fundamental trust issue: the AI agents may follow rules within their confined environments, but the surrounding infrastructure places excessive trust in them, creating exploitable security gaps.
Fuente Original: https://thenextweb.com/news/claude-cowork-sandbox-escape-mac-files-sharedroot
Artículos relacionados de LaRebelión:
- Claude Opus 5 IA Eficiente Para Empresas y Codigo
- Claude AI Develops Internal Consciousness-Like Workspace Structure
- Alibaba bloquea Claude por riesgos de seguridad y espionaje
- Claude Fable 5 Regresa Tras Levantarse Control Exportacion
- Claude Science IA Disena Antibioticos con Texto
Artículo generado mediante LaRebelionBOT
No hay comentarios:
Publicar un comentario