# CVE-2026-46331: SharedRoot: Escaping the Claude Cowork Sandbox to Read the Host Mac Filesystem

> CVE-2026-46331 is a high-severity credential theft issue in Claude Cowork with local execution on a host with a vulnerable kernel, an AI agent. Affected: Claude Cowork with local execution on a host with a vulnerable kernel.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-46331
- **Aliases:** ti-062
- **Severity:** high
- **Attack type:** Credential theft, Privilege escalation, Sandbox escape
- **Component:** Claude Cowork with local execution on a host with a vulnerable kernel (AI agent)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-07-23
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-46331

## Summary

Accomplish AI chained a public Linux kernel flaw in the traffic-control act_pedit module (CVE-2026-46331, a page-cache poisoning bug, assigned to the kernel and NOT to Claude Cowork) into a full escape from the Cowork sandbox. An unprivileged user inside the sandbox could then read and write host Mac files well outside the connected folder, including SSH keys and cloud credentials, with no permission prompt. Anthropic closed the report as Informative rather than actionable; Cowork now uses cloud execution by default, so the local path largely does not apply there.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Claude Cowork with local execution on a host with a vulnerable kernel | no fixed version listed |

## Am I affected by CVE-2026-46331?

You are affected if you run Claude Cowork with local execution on a host with a vulnerable kernel.

## How do I fix CVE-2026-46331?

Scope the host filesystem mount to connected folders only, never the whole host read-write. Disable unprivileged user namespaces, block unshare and AF_NETLINK via seccomp, and stop autoloading unused kernel modules on machines that run local agent sandboxes.

## How do I find every machine running Claude Cowork with local execution on a host with a vulnerable kernel?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Claude Cowork with local execution on a host with a vulnerable kernel and which version, then enforce a policy on it.

## References

- article: https://www.accomplish.ai/blog/sharedroot-escaping-claude-cowork-sandbox/
- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-46331

## Related vulnerabilities

- [GHSA-wp6x-29qx-fpr7](https://catalog.anomity.ai/vuln/ghsa-wp6x-29qx-fpr7) — high
- [openai-codex-two-sandbox-escapes-apply-patch-overpatch-in-codex-cli-and](https://catalog.anomity.ai/vuln/openai-codex-two-sandbox-escapes-apply-patch-overpatch-in-codex-cli-and) — high
- [claude-code-silently-patched-five-permission-and-hook-bypasses-across-2](https://catalog.anomity.ai/vuln/claude-code-silently-patched-five-permission-and-hook-bypasses-across-2) — high
- [opencode-console-breach-saved-openai-anthropic-and-google-provider-keys](https://catalog.anomity.ai/vuln/opencode-console-breach-saved-openai-anthropic-and-google-provider-keys) — high
- [symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot](https://catalog.anomity.ai/vuln/symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot) — high
- [manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction](https://catalog.anomity.ai/vuln/manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-46331