2026-07-27

Claude Cowork’s Mac sandbox escape is the kind of bug that makes agent security feel very real

If you build with Claude or Claude Code, this story lands in the uncomfortable place where demo convenience meets actual machine access. The whole point of a local agent is that it can touch your files and do useful work; the whole problem is keeping that access narrow enough that a single bad prompt, or a malicious one, doesn’t turn into full-system exposure.

Key Points

Security researchers found that Claude Cowork could escape the sandbox meant to contain it on macOS.
The exploit was dubbed ShareRoot by researchers, and it could let an attacker read and write files anywhere on the Mac.
It could also expose login credentials for online services stored on the machine.
Anthropic’s intended protections were twofold: run Cowork inside a virtual machine, and limit file access to only the folders the user explicitly approved.
Researchers said they were able to break both protections with a single short message.
The article says about 500,000 macOS users running local Cowork sessions were affected before the issue was patched.
A later version defaults to cloud execution, which avoids the local escape path.
Users who still run the agent locally remain exposed unless they harden their setups by disabling unprivileged user namespaces, restricting filesystem sharing, and running the daemon with strict mount protections.
The piece notes this comes after a separate OpenAI agent sandbox escape that led to compromised Hugging Face servers.

My Take

What strikes me is how quickly the nice, tidy story of “the agent only sees what I allow” falls apart once you put an LLM agent on a real desktop. The security model sounds sensible on paper: VM isolation plus explicit folder permissions. But if one short message can punch through that layer, then the difference between “helpful local assistant” and “machine compromise” is thinner than most product demos suggest.

I think the most important detail here is not just that the escape happened, but that it targeted the exact trust boundary developers care about. Claude-like tools are attractive because they can work with local codebases, credentials, and artifacts. That same access is why a bug like this is so serious. If an agent can touch your repo, your SSH material, or your browser/session data, the blast radius stops being theoretical.

I’d be curious whether more teams will simply give up on local execution for sensitive workflows and stay cloud-first, at least by default. That feels like the practical move. Local agents are still exciting, but after stories like this, I’m much less impressed by “runs on your Mac” as a feature. It’s convenient, sure. It’s also a security tax you have to pay very carefully.

If I were using Claude Cowork or a similar agent, I’d treat local execution as something to opt into only when I really need it, and only after checking the hardening guidance myself. The cloud default mentioned here sounds like the safer posture, and honestly, that is probably the boring answer that wins.

The takeaway is simple: agentic tooling is getting powerful faster than its safety boundaries are proving themselves. That doesn’t kill the category, but it does mean developers need to think like security engineers a lot earlier than they used to.