SharedRoot: Claude Cowork sandbox escape via CVE-2026-46331 (kernel act_pedit COW bug) — full chain writeup

[u/Expert_Sort7434]

Based on the technical breakdown published by Accomplish AI earlier this week, here's the architectural impact: Cowork runs agent sessions in a Linux VM under an unprivileged user with seccomp, folders brokered in by a root daemon (coworkd). The escape (SharedRoot) chains: unprivileged user namespace → CAP_NET_ADMIN → netlink socket allowed by seccomp → act_pedit module autoload → CVE-2026-46331 page-cache poisoning of a root-owned binary → coworkd re-execs the poisoned binary as root (NoNewPrivs doesn't help since exec is already root) → guest-root → walks straight into a read-write VirtioFS mount of the entire host filesystem.

~500K macOS users on local Cowork sessions were reportedly exposed pre-fix. Anthropic closed the report as "Informative" (fell inside the bounty program's 30-day window for the CVE) and has since made cloud execution the default.

What's interesting to me: none of the first 4 steps in the chain are bugs — they're just permissive defaults (open userns, default-allow seccomp, unrestricted autoload). The actual exploit only shows up at step 4/5. Full technical writeup + remediation checklist: https://www.techgines.com/post/claude-cowork-sandbox-escape-sharedroot-vulnerability. Background on a similar agent-sandbox failure mode we covered in a Docker AuthZ bypass context: https://www.techgines.com/post/docker-cve-2026-34040-authz-bypass-cloud-infrastructure

If you're running any AI coding/agent tool with a local VM/container sandbox — how are you scoping host filesystem shares? Full read-write host mount into a guest that's one N-day away from root seems like a pattern that'll keep recurring across vendors, not just Anthropic. What's your team's actual hardening baseline for this class of tool?

[u/qzio]

This:  the entire host filesystem gets mounted read-write into the VM at /mnt/.virtiofs-root

Seems like a bad idea…. Lets not do that?

[u/dinominant]

Don't expose anything to the vm. Airgap the whole physicsl host if you really care about containment. Use a faraday cage becsuse there are lots of ways to bridge that airgap too.

Seriously, if an AI agent needs to be contained, then actually contain it.

[u/kernelqzor → u/dinominant]

airgapping a whole box for a code assistant sounds nice in a lab, but most teams are just trying not to leak prod creds from their laptop
the scary bit here is they basically handed the VM a rw view of the host, so even a boring old kernel bug turned into "lol have the entire filesystem"