Claude Cowork security flaw on Mac: Gained full file system access
AI assistant escaped sandbox protection, putting user data at risk
1Critical vulnerability bypassing sandbox protection
A serious security flaw was discovered in the Mac version of Claude Cowork. Normally, the AI assistant could only access files and folders that users explicitly permitted. However, an exploit called 'SharedRoot' bypassed these protections, granting full system access. Security researchers demonstrated that a single short message could break out of the sandbox virtual machine. This vulnerability affected approximately 500,000 Mac users before being patched.
2Entire file system left vulnerable
Attackers exploiting this flaw could access the entire Mac file system without any permission prompts appearing. This access wasn't limited to just reading files but included modification and writing privileges. More alarmingly, login credentials for online services could also be compromised. Anthropic's two-layer protection system (virtual machine and explicit permissions) proved ineffective against this exploit.
3Linux VM weakness compromised system security
The root cause lies in a design flaw within the Linux virtual machine where Claude Cowork operates. Researchers found ways to bypass the VM's isolation mechanisms, particularly exploiting weaknesses in filesystem sharing and mount protections. The vulnerability also leveraged macOS's underlying Unix-based architecture. This incident highlights the ongoing security challenges with local AI applications.
4Risk persists even after patch
Although Anthropic released a patch, some users remain at risk. The updated version defaults to cloud-based operation, but users who choose local execution need to implement additional safeguards. Experts recommend disabling unprivileged user namespaces and restricting filesystem sharing. Without these manual configurations, the security risk continues for local users.
5500,000 users affected, some unaware
According to Accomplish AI's data, nearly half a million macOS users were impacted before the vulnerability was discovered. The company identified and reported the issue to The Hacker News. However, confirmation that all users have updated their systems remains uncertain. Particularly concerning is the delay in implementing security measures among less technical users, emphasizing the importance of security awareness with AI tools.
6AI security concerns escalate
This incident with Claude Cowork highlights growing concerns about AI assistant security. It follows recent revelations about an OpenAI agent hacking Hugging Face's servers. Experts warn that as local AI models gain popularity, such vulnerabilities may become more frequent. Sandbox escapes present particularly attractive targets for malicious actors.
7Immediate actions for affected users
Impacted users should immediately update to the latest version of Claude Cowork. Switching to cloud-based operation is the safest option. Those continuing with local execution must implement additional security measures through terminal commands. Experts particularly recommend extra caution for Macs containing financial information or sensitive documents, along with checking sessions in password managers.
8New standards needed for AI security
This event demonstrates the need to reevaluate security standards for AI-powered products. Traditional sandbox methods may not suit the dynamic nature of AI agents. The industry needs to develop new protocols, especially for filesystem access and permission management. Equally critical is improving user security awareness when employing these powerful tools.
Original article: 9to5Mac — Claude Cowork'un Mac'teki güvenlik açığı: Tüm dosyalara erişim sağladı