Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files

A critical sandbox escape vulnerability in Anthropic's Claude Cowork allowed AI agents running inside a Linux VM to break out of their isolated environment and access sensitive files on the host macOS system, including SSH keys and cloud credentials. The attack chain relied on CVE-2026-46331, an unpatched Linux kernel flaw that granted root access within the VM — demonstrating how a single unpatched component can undermine an entire security boundary. This matters because AI agent platforms are increasingly trusted with privileged access to developer environments, making them high-value targets where a compromise can cascade into cloud infrastructure breaches. The fact that Anthropic closed the report as merely 'informative' rather than critical raises concerns about vendor accountability in assessing AI-specific attack surfaces.