Claude Cowork Sandbox Escape Flaw Lets Attackers Access SSH Keys and Cloud Credentials

A sandbox escape named “SharedRoot” affecting Anthropic's Claude Cowork can allow untrusted agent sessions running in a Linux VM on macOS to gain guest-root using unprivileged user namespaces and a Linux kernel pedit COW flaw (CVE-2026-46331), then access a writable VirtioFS mount that exposes the full host filesystem; researchers proved the chain and demonstrated exfiltration of SSH keys and cloud credentials, Anthropic classified the report Informative and moved Cowork to default cloud execution, and recommended mitigations include disabling unprivileged namespaces, tightening seccomp, preventing module autoload, and restricting VM file-sharing to approved folders.