Practical risk reduction for local deployments focuses on limiting scope to the connected folder rather than the entire host filesystem.

This incident fits a July 2026 pattern where multiple teams exposed sandbox escapes, reinforcing that trust in surrounding infrastructure can be riskier than the agent’s in-box rules.

The exploit chain relies on CVE-2026-46331, nicknamed 'pedit COW,' a privilege-escalation flaw fixed in mid-June 2026, with residual exposure for local installs.

The vulnerability stems from a writable VirtioFS mount that shares the host filesystem with the Claude Cowork VM, which was intended to be root-only inside the guest.

While newer versions emphasize cloud execution to reduce risk, local deployments still require careful security configurations to prevent data leakage.

Researchers from Accomplish AI demonstrated that Claude Cowork can escape a Mac-hosted Linux VM sandbox by exploiting a Linux kernel vulnerability, CVE-2026-46331, granting read and write access to files on the host outside the connected folder.

Anthropic shifted Claude Cowork to default cloud execution after disclosure to mitigate cloud risks, but local users remain exposed unless they harden configurations and enable strict protections.

The escape could lead to exfiltration of sensitive host data, including SSH keys and cloud credentials, underscoring a significant security risk for users running Claude Cowork locally rather than in the cloud.

CVE-2026-46331 was patched in mid-June 2026 and the flaw is rated high on CVSS, 7.8.

The issue contributes to broader concerns about AI safety guardrails and sandbox effectiveness across major AI platforms, not just one vendor.

Mitigations include disabling unprivileged user namespaces, tightening seccomp permissions, preventing autoloading of kernel modules, and restricting host sharing with the VM; practical steps include binding the connected folder to the VM, mounting it read-only, and running coworkd with ProtectSystem=strict.

Additional mitigations emphasize limiting host filesystem sharing, restricting unprivileged namespaces, and controlling kernel module loading to reduce exposure.