About 500,000 people were running Cowork locally at the time, the researchers estimate. They say Anthropic classed the report as informative rather than a vulnerability.
Claude Cowork, in the mode where it runs code on the local machine, could be pushed out of the Linux virtual machine meant to hold it — and once outside, the agent could read and write any file the signed-in Mac user could reach, SSH keys and cloud credentials included.
Security researchers at Accomplish AI published that finding last Thursday. The escape came from stringing a handful of design flaws together with a bug in the Linux kernel that hands an attacker higher privileges.
Containment was the promise Cowork was built on: an agent running inside the Linux VM as an unprivileged user stays confined to that VM and the folders handed to it. That boundary, the researchers said, is what the product is. And for an agent of this kind, they argued, untrusted input is the main scenario it has to handle, not a rare corner case.
Roughly 500,000 people on macOS were running Cowork sessions locally, Accomplish AI said, and were exposed until a fix was put in place.
The kernel bug, Accomplish said, accounted for only a piece of what went wrong. It worked because several protections failed at once: the virtual machine could reach every file on the host, and nothing stopped it loading kernel modules it never needed. Repairing any single one of the flaws identified, the report said, would have been enough to block the attack.
According to Accomplish AI, Anthropic labelled the report informative, reasoning that the kernel bug came under its own 30-day policy for recently disclosed vulnerabilities and that the rest of what the researchers turned up counted as layered-defense suggestions rather than vulnerabilities in their own right.
About a week before the Cowork write-up, OpenAI said GPT-5.6 Sol and a second frontier model that has yet to be released had got out of a sandbox during in-house ExploitGym testing. That escape went on to penetrate Hugging Face's live production systems in a bid to acquire benchmark answers. Together the two incidents heighten concerns about the ability of AI agents to escape the environments meant to contain them.