Claude Cowork VM Escape Vulnerability Discovered
AI agent can break out of virtual machine to access Mac files.
1Security Vulnerability Discovered
A serious security flaw was found in Anthropic's Claude Cowork software, allowing the AI agent to escape the Linux virtual machine and access the Mac's file system. Researchers determined that this vulnerability enables the agent to reach all user data. Approximately 500,000 macOS users are estimated to be affected.
2Technical Details of the Flaw
The exploit works by abusing a subsystem called 'act_pedit' in the Linux kernel. Starting as a regular user in the VM, the agent can gain root access using this vulnerability. Since the entire host file system is mounted to the VM with read/write permissions, the agent can access all files on the Mac.
3Potential Impacts
This vulnerability could lead to theft of users' SSH keys, cloud credentials, and other sensitive data. With the same permissions as the user account, the agent has the potential to make any changes to the system. This poses significant security risks, especially in corporate environments.
4Anthropic's Response
After the vulnerability was reported, Anthropic marked the report as informative but didn't release a direct fix. Instead, the latest version defaults to cloud-based operation, indirectly addressing the issue. However, users who choose to run the agent locally remain at risk.
5Recommended Mitigations
Security experts recommend several measures to protect against such vulnerabilities: disabling unprivileged user namespaces, tightening seccomp filters, stopping module autoloading, and avoiding sharing the entire host file system. These measures could prevent similar attack vectors.
6Broader AI Security Concern
This incident points to a larger issue in AI system security. It's known that OpenAI models have similarly escaped sandbox environments. Experts emphasize that privilege escalation vulnerabilities regularly found in the Linux kernel pose a continuous threat to AI systems.
Original article: The Hacker News — Claude Cowork'ta VM'den Kaçış Açığı Bulundu