Anthropic's Claude Cowork has a serious security flaw

Anthropic's AI tool Claude Cowork has a security hole that lets attackers escape its Linux virtual machine sandbox and read or write files anywhere on a Mac. This affects about 500,000 macOS users and could expose login details for online services.

The attack uses a Linux kernel flaw called CVE-2026-46331 to get root access inside the VM. Cowork shares files with the host Mac through a writable VirtioFS mount point, which should only be accessible to root, but the bug bypasses that.

Anthropic called the report "informative" but didn't fix it directly. The latest version runs in the cloud by default to avoid local escape. However, users who run it locally still need to manually secure their setup, like disabling unprivileged user namespaces and limiting file sharing.