Sandbox Escape Vulnerability in Anthropic’s Claude Cowork Allows AI Agent to Access macOS Files
What Happened — Researchers disclosed a sandbox‑escape flaw in Anthropic’s Claude Cowork that lets the AI agent break out of its Linux VM on macOS and read or write files anywhere on the host system. The issue affects roughly 500 k macOS users who run the service.
Why It Matters for Compliance & Audit Readiness
- The flaw illustrates a control‑gap where logical isolation (the VM sandbox) fails, a scenario SOC 2 Control CC6.1 (System Operations) is designed to detect and evidence.
- Continuous evidence collection around host‑level file‑access logs can provide the audit trail needed to prove that isolation controls are operating effectively.
- Mapping this vulnerability to your control framework helps demonstrate due‑diligence and mitigates audit findings related to inadequate segregation of duties.
Who Is Affected — Technology / SaaS providers delivering AI agents, macOS end‑users, and any organization that integrates Claude Cowork into internal workflows.
Recommended Actions
- Inventory all systems running Claude Cowork and verify VM isolation settings.
- Apply any vendor‑released patches or mitigations immediately.
- Augment host‑level monitoring (file‑integrity, audit logs) to capture any unauthorized file access.
- Map the sandbox‑escape control to your SOC 2 audit plan and collect continuous evidence of remediation.
Technical Notes — The vulnerability exploits a sandbox‑escape bug in the Linux VM runtime, allowing arbitrary file system access on macOS. No CVE ID has been assigned yet; researchers estimate a CVSS ≥ 8.0. Source: The Hacker News