Breaking Lab srl
A Wall That Wasn’t There
When Anthropic built Claude Cowork, the premise was straightforward: give the AI agent a sandboxed Linux virtual machine in which to do its work, keeping the host operating system safely out of reach. A newly disclosed vulnerability has shattered that assumption. Researchers at Accomplish AI have demonstrated that an attacker — or a maliciously crafted prompt — can coax the agent into escaping that Linux VM entirely and gaining read and write access to arbitrary files anywhere on the underlying macOS host. With roughly 500,000 macOS users running the software, the blast radius of the flaw was anything but hypothetical.
How the Escape Works
The vulnerability is a classic sandbox escape, but its context makes it particularly striking. Claude Cowork is designed to act as an autonomous AI agent capable of executing code, managing files, and completing multi-step tasks on a user’s behalf. To limit the damage any runaway or manipulated instruction could cause, the agent’s runtime lives inside a Linux VM that is supposed to act as a hard boundary between the agent’s actions and the real Mac filesystem.
Accomplish AI found that this boundary could be crossed through a chain of steps that exploited weaknesses in how the VM’s shared filesystem was configured and how the agent interpreted file path references. By crafting specific instructions — potentially deliverable through a prompt injection attack — a malicious actor could redirect the agent’s file operations outside the VM’s designated mount points and into directories owned by the host macOS system. From there, reading sensitive configuration files, SSH keys, or browser credentials, or even writing malicious payloads into startup locations, became achievable without any additional privileges.
Accomplish AI coordinated disclosure with Anthropic before publishing their findings, giving the company time to issue a patch. Anthropic has since addressed the vulnerability, though the researchers have chosen to share technical details to raise awareness of the broader class of risk.
Why Agentic AI Makes Sandbox Failures Worse
Traditional application sandboxes, when they fail, typically mean a single piece of software can touch things it should not. An AI agent failure is qualitatively different. Because these systems are designed to interpret natural language instructions and act autonomously across a wide range of tasks, a sandbox escape transforms the entire agent into a potential attack surface. A single well-crafted prompt — embedded in a webpage the agent visits, a document it processes, or a calendar event it reads — could theoretically initiate the escape chain without the user ever being aware.
This is not a theoretical concern confined to Claude Cowork. As AI agents become more capable and more deeply integrated with operating systems, email clients, and cloud storage services, the attack surface they present grows proportionally. Prompt injection, where hostile instructions are smuggled inside content that an agent is asked to process, has already been demonstrated against several major platforms. Pairing that technique with a sandbox escape vulnerability creates a scenario where remote code execution on a target machine requires no user interaction beyond having an AI agent installed and running.
The Broader Stakes for AI Deployment
Anthropic is far from alone in facing these challenges. OpenAI’s Operator, Google’s Project Mariner, and a growing ecosystem of third-party agent frameworks all grapple with the same fundamental tension: to be useful, an agent must have meaningful access to a user’s environment, but that access must be tightly constrained to prevent abuse. The Claude Cowork flaw is a reminder that virtual machine isolation, while a sound architectural choice, is not a silver bullet — its effectiveness depends entirely on the rigor with which shared resources, mount points, and path resolution are configured and audited.
What this episode ultimately underscores is that the security engineering required to deploy AI agents safely is still maturing at a pace that lags behind the commercial urgency to ship. As agents move from novelty to essential productivity tool, the industry will need systematic, independently verified sandboxing standards — not ad hoc containment strategies — before 500,000-user exposure windows become routine rather than exceptional.
