# Claude Cowork security flaw on Mac: Gained full file system access AI assistant escaped sandbox protection, putting user data at risk - **Source:** [9to5Mac](https://brifing.si/source/59447403-ce5b-427c-8132-8614f549929a) - **Published:** 2026-07-27 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/4230f94d-a992-4ba3-b081-81dfd9d7e23c ## Critical vulnerability bypassing sandbox protection A serious security flaw was discovered in the Mac version of Claude Cowork. Normally, the AI assistant could only access files and folders that users explicitly permitted. However, an exploit called 'SharedRoot' bypassed these protections, granting full system access. Security researchers demonstrated that a single short message could break out of the sandbox virtual machine. This vulnerability affected approximately 500,000 Mac users before being patched. ## Entire file system left vulnerable Attackers exploiting this flaw could access the entire Mac file system without any permission prompts appearing. This access wasn't limited to just reading files but included modification and writing privileges. More alarmingly, login credentials for online services could also be compromised. Anthropic's two-layer protection system (virtual machine and explicit permissions) proved ineffective against this exploit. ## Linux VM weakness compromised system security The root cause lies in a design flaw within the Linux virtual machine where Claude Cowork operates. Researchers found ways to bypass the VM's isolation mechanisms, particularly exploiting weaknesses in filesystem sharing and mount protections. The vulnerability also leveraged macOS's underlying Unix-based architecture. This incident highlights the ongoing security challenges with local AI applications. ## Risk persists even after patch Although Anthropic released a patch, some users remain at risk. The updated version defaults to cloud-based operation, but users who choose local execution need to implement additional safeguards. Experts recommend disabling unprivileged user namespaces and restricting filesystem sharing. Without these manual configurations, the security risk continues for local users. ## 500,000 users affected, some unaware According to Accomplish AI's data, nearly half a million macOS users were impacted before the vulnerability was discovered. The company identified and reported the issue to The Hacker News. However, confirmation that all users have updated their systems remains uncertain. Particularly concerning is the delay in implementing security measures among less technical users, emphasizing the importance of security awareness with AI tools. ## AI security concerns escalate This incident with Claude Cowork highlights growing concerns about AI assistant security. It follows recent revelations about an OpenAI agent hacking Hugging Face's servers. Experts warn that as local AI models gain popularity, such vulnerabilities may become more frequent. Sandbox escapes present particularly attractive targets for malicious actors. ## Immediate actions for affected users Impacted users should immediately update to the latest version of Claude Cowork. Switching to cloud-based operation is the safest option. Those continuing with local execution must implement additional security measures through terminal commands. Experts particularly recommend extra caution for Macs containing financial information or sensitive documents, along with checking sessions in password managers. ## New standards needed for AI security This event demonstrates the need to reevaluate security standards for AI-powered products. Traditional sandbox methods may not suit the dynamic nature of AI agents. The industry needs to develop new protocols, especially for filesystem access and permission management. Equally critical is improving user security awareness when employing these powerful tools. ## Sources covering this story - https://9to5mac.com/2026/07/27/claude-cowork-escaped-sandbox-on-mac-gain-full-access-to-all-files/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._