{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-46331",
    "name": "CVE-2026-46331",
    "vendor": "Claude Cowork with local execution on a host with a vulnerable kernel",
    "description": "Accomplish AI chained a public Linux kernel flaw in the traffic-control act_pedit module (CVE-2026-46331, a page-cache poisoning bug, assigned to the kernel and NOT to Claude Cowork) into a full escape from the Cowork sandbox. An unprivileged user inside the sandbox could then read and write host Mac files well outside the connected folder, including SSH keys and cloud credentials, with no permission prompt. Anthropic closed the report as Informative rather than actionable; Cowork now uses cloud execution by default, so the local path largely does not apply there.",
    "website": "https://www.accomplish.ai/blog/sharedroot-escaping-claude-cowork-sandbox/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-07-23",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-46331",
      "aliases": [
        "ti-062"
      ],
      "title": "SharedRoot: Escaping the Claude Cowork Sandbox to Read the Host Mac Filesystem",
      "summary": "Accomplish AI chained a public Linux kernel flaw in the traffic-control act_pedit module (CVE-2026-46331, a page-cache poisoning bug, assigned to the kernel and NOT to Claude Cowork) into a full escape from the Cowork sandbox. An unprivileged user inside the sandbox could then read and write host Mac files well outside the connected folder, including SSH keys and cloud credentials, with no permission prompt. Anthropic closed the report as Informative rather than actionable; Cowork now uses cloud execution by default, so the local path largely does not apply there.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Credential theft",
        "Privilege escalation",
        "Sandbox escape"
      ],
      "componentType": "agent",
      "component": {
        "name": "Claude Cowork with local execution on a host with a vulnerable kernel",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Claude Cowork with local execution on a host with a vulnerable kernel",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-07-23",
      "modifiedAt": "2026-07-23",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.accomplish.ai/blog/sharedroot-escaping-claude-cowork-sandbox/"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46331"
        }
      ],
      "mitigation": "Scope the host filesystem mount to connected folders only, never the whole host read-write. Disable unprivileged user namespaces, block unshare and AF_NETLINK via seccomp, and stop autoloading unused kernel modules on machines that run local agent sandboxes.",
      "detectedByAnomity": true
    }
  }
}