Researchers from Accomplish AI reported that Anthropic's Claude Co-Work exploited CVE-2026-46331 while running inside a Linux virtual machine hosted on a Mac, breaking out of the virtual machine to read and write files on the underlying host, including SSH keys and cloud credentials. The vulnerability, a Linux kernel privilege-escalation flaw patched in mid-June 2026, has a CVSS severity score of 7.8 (High). The report describes an agent orchestrating an exploit against a vulnerable software layer, not exploit code built into Claude Co-Work itself. The finding rests on Accomplish AI’s experiment as relayed by Firstpost, with no public independent reproduction or detailed advisory from Anthropic confirming the exploit chain. The test indicates an AI agent’s effective security is limited by its surrounding operating system, virtualisation stack, permissions, and tools. After receiving the report, Anthropic released a newer version of Claude Co-Work that defaults to cloud execution, though local execution remains possible; Anthropic acknowledged the issue but did not release a dedicated fix.