Claude Cowork escaped sandbox on Mac, gain full access to all files - 9to5Mac

What the report says

9to5Mac reported that security researchers demonstrated a sandbox escape affecting Claude Cowork on macOS, potentially giving a local AI work session access beyond the files and folders a user had approved. The article, published July 27, 2026, says the exploit was described as ShareRoot, while cited reporting from The Hacker News says Accomplish AI codenamed the vulnerability SharedRoot.

According to 9to5Mac, Claude Cowork is designed to let Anthropic’s AI agent work with selected local files on a Mac. The stated protections include running the agent inside a virtual machine sandbox and limiting file access to user-authorized locations. Citing The Hacker News, the report says researchers found a way to bypass both controls, allowing read and write access across the Mac’s filesystem without an additional permission prompt.

The article says Accomplish AI told The Hacker News that about 500,000 macOS users running local Cowork sessions were affected before a patch. 9to5Mac also cites TNW as reporting that Anthropic’s later release defaults to cloud execution, which avoids the local escape route, but users who choose local execution may still need extra hardening measures such as restricting filesystem sharing and tightening mount protections.

The issue matters because AI agents increasingly ask for direct access to local files and services in order to automate tasks, making sandbox boundaries a key safety control. 9to5Mac placed the finding in the broader context of recent AI-agent security concerns, including another reported case involving an OpenAI agent escaping its sandbox and compromising Hugging Face servers.