Claude Cowork Sandbox Escape Let AI Agent Read and Write Files Anywhere on a Mac

Key points

• Accomplish AI disclosed a sandbox escape in Anthropic's Claude Cowork agent that lets it break out of its Linux virtual machine and touch any file on the host Mac.
• The researchers estimate around 500,000 macOS users run the affected agent.
• A sandbox is the walled-off area meant to keep an AI agent from reaching the rest of your computer; this flaw breaks that wall.
• The bug lets the agent read or write files anywhere on the Mac, including personal documents and credentials.

Claude Cowork, Anthropic's coding assistant that runs tasks on a developer's behalf, has a security hole that undoes its main safety promise. That promise is simple: the agent works inside a Linux virtual machine, a small simulated computer running inside your real one, so it cannot rummage through your actual files. Researchers at Accomplish AI say they broke that wall.

The result is a sandbox escape. The AI agent can climb out of its playpen and onto the host Mac, where it can read your documents or drop new files of its own.

What did the researchers actually find?

Accomplish AI found a way for code running inside the Claude Cowork virtual machine to reach files on the underlying macOS system. Anything the logged-in user can see, the escaped agent can see too. That includes personal folders and any credentials stored in plain files.

The firm shared its writeup with The Hacker News before publishing. Technical specifics on the exact escape path were held back at the time of disclosure.

Who is affected?

Around 500,000 macOS users running Claude Cowork, according to Accomplish AI's estimate. If you've installed the agent on a Mac and used it for coding tasks, assume you're in scope until Anthropic confirms a fixed version.

Why does a sandbox escape matter?

The sandbox is the whole point. Users hand an AI agent broad instructions and let it run code, on the understanding that it can't reach outside a controlled box. When that box leaks, every assumption behind "let the agent try it" breaks.

For a coding agent specifically, the exposure is serious. Developers keep SSH keys, cloud tokens, and source code on the same machine. A silent read of the home directory is enough to hand an attacker access to a company's cloud accounts. It's the kind of quiet loss that takes weeks to notice.

This isn't Anthropic's first boundary problem we've reported. Our 15 July story on the Claude Desktop app found that a single malicious instruction could silently steal private files; two days later we reported the Chrome extension bugs were patched.

How did the hackers get in?

Nobody has, as far as anyone knows. This is researcher-disclosed, not an active breach. The risk is that a malicious prompt or a poisoned dependency fed to the agent could trigger the escape and reach files it should never see.

That matters because agents are designed to fetch and run untrusted content. The threat model isn't a hacker sitting at your keyboard. It's the agent being tricked into acting against you.

What should Claude Cowork users do?

Update the moment Anthropic publishes a patched build, and check the Claude release notes for the fixed version number before trusting the agent with sensitive projects. Until then, treat the agent as if it has full access to your Mac: don't run it on machines holding production credentials or signing keys. Rotate any tokens and SSH keys that lived on a machine where Cowork has been running untrusted tasks.

Regulator angle: no filings yet. If exploitation is later confirmed against EU or UK users, data protection authorities would expect breach notification under GDPR within a tight statutory window. US users would look to the FTC for enforcement on deceptive security claims about the sandbox.