Claude Cowork could search your entire Mac without ever asking for the slightest permission.

All agents that write code rely on the same promise: they are confined to an enclosed space, given access to a specific folder, and allowed to work with peace of mind. Security researchers have just demonstrated that, with Anthropic’s desktop agent, this enclosed space was more like a line drawn on the ground than a load-bearing wall.They attached a folder to a new session, sent a brief message, and watched the agent exit.

The entire Mac was already inside the sandbox

The macOS application launches a Linux virtual machine and installs the agent there under an account with no privileges, which looks like a serious precaution. One step further down, the mechanics are considerably less reassuring: the Mac’s root filesystem is mounted read-write in this virtual machine, accessible only to the superuser of the guest system. The bank vault was therefore sitting in the entrance hall, its only protection being that the key was kept up high.

Read also: Claude Opus 5 – what Anthropic did not tell you about its new AI

The session could create a network namespace, use it to gain administrative privileges, and then trigger the automatic loading of a Linux kernel module affected by a public vulnerability. Once superuser access had been obtained on the virtual machine side, everything became readable and writable with the logged-in user’s permissions: SSH keys, online service credentials and the rest of the disk, far beyond the folder initially shared.

Anthropic preferred to move the problem rather than fix it

The report reached Anthropic, which classified it as “informational” without publishing a code fix.The next version of the tool shifts execution to the company’s servers by default, closing off the local attack path without changing anything for those who continue to work on their own machine. The sticking point lies in the mitigation recommended by the researchers, namely preventing unnecessary modules from being loaded automatically. It has already been applied in the tool to another module, specifically to close an earlier vulnerability. The pattern was already present in the image; it simply was not extended.

The company Accomplish AI, which originated the discovery, cites the figure of 500,000 macOS users affected before the switch, an estimate that it alone stands behind. No actual exploitation has been observed; this is a demonstration conducted in a laboratory rather than an ongoing campaign.

👉🏻 Follow tech news in real time: add 01net to your sources on Google, and subscribe to our WhatsApp channel.

Source: Accomplish AI