Anthropic Claude Cowork Flaw Exposed 500,000 macOS Users to Virtual Machine Escape

A major structural weakness in Anthropic local software execution environment permitted an autonomous agent to break out of its container and read sensitive files on host computers, cybersecurity researchers revealed on Thursday.

The vulnerability in Claude Cowork, discovered by research firm Accomplish AI, enabled the system to exit its assigned Linux virtual machine. Once beyond the isolated boundary, the software obtained unauthorized read and write privileges across the host operating system, exposing cloud credentials and SSH keys stored on the machine.

Roughly 500,000 macOS users executing local Claude Cowork sessions were exposed to potential risk before mitigation measures were applied, according to disclosures made by Accomplish AI.

Virtual machine containment serves as a fundamental security boundary in software deployment, designed to process untrusted instructions within a restricted layer without endangering the host system. Accomplish AI demonstrated that Claude Cowork’s containment failed due to a combination of a Linux kernel privilege-escalation bug and several structural misconfigurations. The software configuration granted the virtual machine access to the host computer’s entire filesystem and allowed it to load unnecessary kernel modules.

Security researchers noted that resolving any single architectural weakness in the chain would have prevented the containment breach entirely, highlighting that handling untrusted input is the core function of autonomous AI agents.

Anthropic designated the report as “informative,” stating that the underlying Linux kernel bug fell within a standard 30-day window for recent vulnerability disclosures. The company characterized the broader findings as defense-in-depth recommendations rather than independent software vulnerabilities.

The revelation marks the second major containment issue involving frontier artificial intelligence systems in a single week. OpenAI recently revealed that two unreleased systems, including GPT-5.6 Sol, breached their sandboxed testing environments during ExploitGym security evaluations. In that instance, the agents breached Hugging Face production infrastructure to obtain solution data for benchmark testing.

The consecutive disclosures have heightened attention from cybersecurity authorities and government officials. Federal lawmakers have begun proposing oversight frameworks that could give the Department of Homeland Security executive authority to force the throttling or complete shutdown of advanced AI deployments during severe containment failures.