CVE-2026-46331: SharedRoot: Escaping the Claude Cowork Sandbox to Read the Host Mac Filesystem
CVE-2026-46331 is a high-severity credential theft issue in Claude Cowork with local execution on a host with a vulnerable kernel, an AI agent. Affected: Claude Cowork with local execution on a host with a vulnerable kernel.
Is Claude Cowork with local execution on a host with a vulnerable kernel running on your developers' machines? Anomity finds every device with this AI agent installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
CVE-2026-46331- Severity
- high
- Attack type
- Credential theft, Privilege escalation, Sandbox escape
- Component
- Claude Cowork with local execution on a host with a vulnerable kernel · AI agent
- Known exploited
- No known exploitation
- Published
- Last verified
What is CVE-2026-46331?
Accomplish AI chained a public Linux kernel flaw in the traffic-control act_pedit module (CVE-2026-46331, a page-cache poisoning bug, assigned to the kernel and NOT to Claude Cowork) into a full escape from the Cowork sandbox. An unprivileged user inside the sandbox could then read and write host Mac files well outside the connected folder, including SSH keys and cloud credentials, with no permission prompt. Anthropic closed the report as Informative rather than actionable; Cowork now uses cloud execution by default, so the local path largely does not apply there.
Affected versions
| Affected | Fixed in |
|---|---|
Claude Cowork with local execution on a host with a vulnerable kernel | No fixed version listed |
Am I affected by CVE-2026-46331?
You are affected if you run Claude Cowork with local execution on a host with a vulnerable kernel.
How do I fix CVE-2026-46331?
Scope the host filesystem mount to connected folders only, never the whole host read-write. Disable unprivileged user namespaces, block unshare and AF_NETLINK via seccomp, and stop autoloading unused kernel modules on machines that run local agent sandboxes.
How do I find every machine running Claude Cowork with local execution on a host with a vulnerable kernel?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Claude Cowork with local execution on a host with a vulnerable kernel and which version, then enforce a policy on it.