What is Claude Cowork and how does it differ from Claude Code?

Claude Cowork is Anthropic's AI agent platform for enterprise teams, designed to execute multi-step tasks autonomously inside isolated virtual machine sandboxes on users' machines or in the cloud. Claude Code is a coding assistant tool. Cowork's sandboxed execution model is central to its security promise: the sandbox is supposed to contain any damage if a task goes wrong or a malicious payload reaches the agent.

How serious is this vulnerability for organisations using Claude Cowork?

The macOS vulnerability allowed a malicious payload, reaching Cowork via prompt injection or a compromised tool call, to escape the Linux VM sandbox and access any file readable by the logged-in Mac user. This includes SSH private keys, AWS and GCP credential files, .env files, and browser session data. Around 500,000 macOS users were estimated to be running local sessions before the patch. Anthropic found no evidence of active exploitation, but the exposure window is significant.

What should security teams do in response?

Update Claude Cowork to the latest version, which defaults to cloud-hosted execution and removes the local VM escape path. Rotate SSH keys, cloud access keys, and any other credentials stored in the home directory of Macs that were running local Cowork sessions on affected versions. Review whether any untrusted content processed by Cowork during that period could have contained prompt injection payloads, particularly if Cowork was used to process external documents, emails, or web content.

Claude Cowork Sandbox Escape Exposed SSH Keys on 500,000 macOS Systems

Researchers at Accomplish AI published details this week of a sandbox escape in Anthropic’s Claude Cowork that allowed a process executing inside the product’s Linux VM to break out and read or write any file accessible to the logged-in macOS user. Anthropic estimates around 500,000 macOS users were running local Cowork sessions prior to the patch. The research is published under the name “SharedRoot.”

What Claude Cowork Is

Claude Cowork is Anthropic’s enterprise AI agent product, designed to execute autonomous multi-step tasks: processing documents, running code, interacting with tools and services. The core security model depends on sandboxing. Cowork runs each task inside an isolated Linux virtual machine, with the promise that even if something goes wrong — a prompt injection attack, a compromised external document, a malicious MCP tool response — the damage is contained within the VM and cannot reach the host.

The sandbox is load-bearing. If it fails, agent execution becomes uncontained on the host machine.

The SharedRoot Vulnerability

The Accomplish AI research identified a misconfiguration in how the Cowork macOS client mounted shared filesystems between the host and the Linux VM. The mount was broader than intended, exposing host directories that should have been outside the sandbox boundary to processes running inside the VM.

A malicious payload reaching Cowork execution could traverse this boundary. The researchers demonstrated extraction of SSH private keys, AWS and GCP credential files, .env files containing API keys, and browser session data — all accessible to the logged-in macOS user. Getting a malicious payload into Cowork execution is precisely the threat model the product is designed to work in: processing untrusted documents, visiting external URLs, handling tool call results from third-party integrations.

The attack does not require prior access to the host machine. It requires only that a prompt injection payload or malicious content reaches a Cowork task, which is the normal use case.

A Second Research Track on Windows

Separately, security researchers at Armadin Inc. disclosed a different vulnerability chain on Windows in March: a mechanism allowing arbitrary command execution as root inside the Cowork sandbox, combined with a secondary flaw that stripped the network restrictions meant to contain it. Anthropic disputed the Windows case, arguing exploitation required pre-existing local code execution on the host.

The Accomplish AI macOS case does not carry that caveat. It requires only a malicious payload in the Cowork execution pipeline.

Anthropic’s Response and the Fix

Anthropic has patched the issue. The fix switches the default Cowork execution mode from local VM to cloud-hosted sessions. In cloud sessions, no VM runs on the user’s machine, which removes this specific attack path. The company said it found no evidence of exploitation before disclosure, and Accomplish AI followed coordinated disclosure practices before publishing.

Users still running older local-execution configurations should update immediately.

The Pattern This Illustrates

Claude Cowork is not the first AI agent product to have its sandbox fail, and it will not be the last. The pattern here is structural: AI agent products that execute arbitrary code rely on isolation layers that are often less mature than the agent capabilities they contain. The sandbox is designed later, tested less rigorously, and carries the same implicit trust that early browser sandboxes did before systematic adversarial testing exposed how fragile they were.

For security teams evaluating or deploying AI agent platforms: the isolation mechanism is a primary security control. It should be independently tested, not assumed correct. The relevant questions are what the agent can access, which credentials are visible to its execution environment, and whether the isolation layer has been subject to adversarial review.

For Cowork specifically: rotate SSH keys and cloud credentials that were accessible from macOS machines running local sessions, particularly if those machines processed any external or untrusted content through Cowork tasks.