Overview
- Security researchers demonstrated a reproducible exploit called SharedRoot that used a fixed Linux kernel flaw, CVE-2026-46331, to escalate privileges inside the guest VM and reach a writable VirtioFS host mount.
- The attack chain required three elements: the pedit COW kernel vulnerability to get guest-root, a read-write VirtioFS mount of the Mac filesystem inside the VM, and a privileged coworkd service that could be coerced to execute altered files.
- Accomplish AI said about 500,000 macOS local Cowork sessions were exposed before remediation, and the researchers reported no evidence the exploit was used outside their controlled tests.
- Anthropic already changed Cowork to default to cloud execution on July 7 to avoid the local VM attack path, and researchers published hardening steps for users who continue to run Cowork locally.
- Users running local Cowork should scope mounts to only needed folders, mount them read-only when possible, run coworkd with strict mount protections, disable unprivileged user namespaces, and rotate any credentials that may have been reachable; the incident highlights broader risks when agents are given local file or command access.