SharedRoot: Sandbox Escape in Claude Cowork

SharedRoot is an attack chain that combines CVE-2026-46331 (a Linux act_pedit traffic-control flaw) with Claude Cowork’s local macOS VM and its host-filesystem sharing to achieve sandbox escape, potentially exposing or modifying files accessible to the logged-in macOS user; researchers demonstrated a PoC on macOS but there is no confirmed in-the-wild exploitation. The report details affected components, exploitability conditions, detection guidance, and mitigations (patch guest kernels, prefer cloud Cowork mode, restrict namespaces/netlink, and narrow host mounts).