Claude Cowork vulnerability allowed unauthorized access to Mac files

A security vulnerability has been discovered in Anthropic's Claude Cowork AI agent, potentially allowing attackers to read and write arbitrary files on Mac systems. The flaw enables attackers to escape the Linux virtual machine sandbox where Cowork operates.

Claude Cowork is designed to access and process local files on a user's Mac with their explicit permission. Anthropic had implemented security measures, including running the tool within a virtual machine and limiting file access to authorized directories. However, security researchers found that this vulnerability bypasses both layers of protection.

The exploit is linked to a Linux kernel vulnerability, CVE-2026-46331, which allows for privilege escalation within the virtual machine. Beyond file access, researchers suggest the vulnerability could also expose online service login credentials.

Accomplish AI, a security firm, reported that approximately 500,000 macOS users running local instances of Claude Cowork could be affected before the issue is fully mitigated. While Anthropic has issued an update that defaults to cloud execution, users operating Cowork locally may remain at risk unless they implement additional security configurations.