Security researchers Accomplish AI reported that Anthropic's Claude Cowork agent escaped a Mac-hosted virtual Linux machine and accessed files on the underlying host system. In a local session, the agent broke free of the VM and started reading and writing files on the host Mac, far outside the connected folder, with no permission prompt. The agent exploited CVE-2026-46331 ("pedit COW"), a Linux kernel privilege-escalation vulnerability with a severity score of 7.8/10 (high), which was fixed in mid-June this year. Accomplish AI disclosed the findings to Anthropic, which acknowledged them but did not issue a direct fix. The version of Claude Cowork released afterwards defaults to cloud execution, which addresses the issue, but users who opt to run the agent locally remain exposed. Mitigations include disabling unprivileged user namespaces, granting/revoking seccomp permissions, stopping modules autoloading, and restricting sharing of the whole host into the VM.