Claude Cowork Sandbox Escape Let AI Agent Read and Write Files Anywhere on a Mac

Key points

• Accomplish AI disclosed a sandbox escape in Anthropic's Claude Cowork agent that lets it break out of its Linux virtual machine and touch any file on the host Mac.
• The researchers estimate around 500,000 macOS users run the affected agent.
• A sandbox is the walled-off area meant to keep an AI agent from reaching the rest of your computer; this flaw breaks that wall.
• The bug lets the agent read or write files anywhere on the Mac, including personal documents and credentials.
• Accomplish AI shared the findings with The Hacker News before going public.

Claude Cowork, Anthropic's coding assistant that runs tasks on a developer's behalf, has a security hole that undoes its main safety promise. That promise is simple: the agent works inside a Linux virtual machine, meaning a small simulated computer running inside your real one, so it cannot rummage through your actual files. Researchers at Accomplish AI say they broke that wall.

The result is a sandbox escape. In plain terms, the AI agent can climb out of its playpen and into the host Mac, where it can read your documents or drop new files of its own.

What did the researchers actually find?

Accomplish AI found a way for code running inside the Claude Cowork virtual machine to reach files on the underlying macOS system. Anything the logged-in user can see, the escaped agent can see too. That includes personal folders, browser data, and any credentials stored in plain files.

The firm shared its writeup with The Hacker News before publishing. Technical specifics on the exact escape path were held back at the time of disclosure.

Who is affected?

Around 500,000 macOS users running Claude Cowork, according to Accomplish AI's estimate. If you have installed the agent on a Mac and used it for coding tasks, assume you are in scope until Anthropic confirms a fixed version.

Why does a sandbox escape matter?

Because the sandbox is the whole point. Users hand an AI agent broad instructions and let it run code, on the understanding that the code cannot reach outside a controlled box. When that box leaks, every assumption behind "let the agent try it" breaks.

For a coding agent specifically, the blast radius is ugly. Developers keep SSH keys, cloud tokens, source code, and customer data on the same machine. A silent read of the home directory is enough to hand an attacker the keys to a company's cloud accounts.

How did the hackers get in?

Nobody has, as far as anyone knows. This is researcher-disclosed, not an active breach. The risk is that a malicious prompt, a poisoned dependency, or a hostile web page fed to the agent could now trigger the escape and reach files it should never see.

That matters because agents are designed to fetch and run untrusted content. The threat model here is not a hacker sitting at your keyboard. It is the agent being tricked into acting against you.

What should Claude Cowork users do?

Update the moment Anthropic publishes a patched build, and check its security advisories page for the fixed version number before trusting the agent with sensitive projects. Until then, treat the agent as if it had full access to your Mac: do not run it on machines holding production credentials, customer data, or signing keys. Rotate any tokens or SSH keys that lived on a machine where Cowork has been running untrusted tasks.

Regulator angle: no filings yet. If exploitation is later confirmed against EU or UK users, the ICO and EU data protection authorities would expect notification under GDPR within 72 hours of a controller becoming aware. US users would look to the FTC for enforcement on deceptive security claims about the sandbox.