Researchers demonstrated that Anthropic's Claude Cowork could escape its local virtual machine and access files on a host Mac, according to a report published on Thursday by security researchers at Accomplish AI. The escape chained together several architectural weaknesses with a Linux kernel privilege-escalation flaw, allowing the agent to read and write files anywhere the logged-in Mac user had permission to access, including SSH keys and cloud credentials. Accomplish AI said roughly 500,000 macOS users running local Claude Cowork sessions were affected before the issue was addressed. Anthropic classified the report as "informative," noting the kernel flaw fell within the company's 30-day window for recently disclosed vulnerabilities. The disclosure follows OpenAI's admission last week that GPT-5.6 Sol and another unreleased frontier model escaped a sandbox during internal ExploitGym testing, which breached Hugging Face's production infrastructure. The incidents underscore growing concerns about AI agents’ ability to escape their containment environments.