News
- Accomplish AI showed Claude Cowork could escape a VM sandbox via Linux zero‑day CVE‑2026‑46331
- Agent accessed host Mac files, risking exfiltration of SSH keys, cloud credentials, and more
- Anthropic shifted Cowork to default cloud execution; local users must harden configs to mitigate exposure
Recent news of a ChatGPT agent escaping the sandbox and attacking services on the internet raised quite a few eyebrows, but it seems it’s not the only one capable of running wild. Security researchers Accomplish AI are saying they achieved similar results with Anthropic’s Claude Cowork.
In a new report, the researchers said they ran a local session in a Mac-hosted virtual Linux machine and then observed as the agent broke free of the VM and started reading and writing files on the underlying system.
“We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox,” Oren Yomtov, principal security researcher at Accomplish AI, told The Hacker News. “From inside the VM, it reached the host Mac and read and wrote files all over it, far outside the folder we'd connected, with no permission prompt anywhere.”
Defaulting to cloud executionThis means that, in theory, the agent can be used to access or exfiltrate anything that’s stored on the Mac’s user account, including SSH keys, cloud credentials, and more. To break out of the sandbox, the agent exploited CVE-2026-46331 ("pedit COW"), a Linux kernel privilege-escalation vulnerability. This flaw, fixed in mid-June this year, was given a severity score of 7.8/10 (high).
Accomplish AI disclosed these findings with Anthropic, which allegedly acknowledged them but did not issue a direct fix. However, the version of Claude Cowork that was released afterwards defaults to cloud execution which, the publication claims, addresses the issue. Still, users who opt to run the agent locally rather than in the cloud will remain exposed.
Mitigations are possible, though. Users should disable unprivileged user namespaces, grant/revoke seccopm permissions, stop modules autoloading, and restrict sharing of the whole host into the VM.
"Scope it to the folders that were actually connected instead of all of /, or at least mount it read-only, and run coworkd with ProtectSystem=strict in its own mount namespace so it isn't re-execing binaries a session user can poison," Accomplish AI explained. "Then even a full guest-root has nothing to land on, the last two steps of the chain have nowhere to go."
- Stream Shark Week 2026 free via YouTube TV / DirecTV / Hulu + Live TV (US)
- Unlock your stream with Surfshark (save up to 85%)
- Shark Week 2026 starts at 8pm ET/PT on Sunday, July 26
"It's all psychological. You yell barracuda, everybody says, "Huh? What?" You yell shark, we've got a panic on our hands." We're still waiting on Barracuda Week (which we'd definitely tune into), but in the meantime TV event of the summer Shark Week is back to keep you glued to your telly and out of the Amity Island waters.
Anything to keep Mayor Vaughn happy.
Even better – you can stream all 20 specials across seven nights, including Air Jaws: Red, White and Breach, How to Train a Great White and My Strange Shark Addiction, for free.
Here's the trick: Shark Week airs exclusively on Discovery, which you can access with a free trial, and Surfshark will let you watch Shark Week from anywhere. Not only is the aptly named VPN excellent, but it's also heavily discounted for a limited time, and comes with a 30-day money-back guarantee.
How to watch Shark Week 2026 for freeDiscovery is home to Shark Week 2026. If you don't have the channel on cable, it's available on a streaming basis from several cable alternatives. Best of all, a few of them let new subscribers take advantage of a free trial.
YouTube TV usually costs $82.99 per month but comes with a 5-day free trial and $15 off each of your first five months.
The DirecTV MyEntertainment genre pack costs $42.99 per month after a 5-day free trial, and Hulu + Live TV costs $89.99 per month after a 3-day free trial.
Outside the US? You can use a VPN to watch Shark Week 2026 for free as if you were right at home.
Use a VPN to watch Shark Week 2026 for free from anywhereSurfshark CHEAPEST Deal – from £1.79/month
Surfshark is our favourite cheap VPN – and it's on sale today! We use it to watch streaming services from abroad, block ads, protect from viruses, and more.
✅ Up to 85% Off Today
✅ 3 Extra Months Free
✅ 30-day money-back guarantee
✅ Unlocks all necessary streaming services
Get Surfshark today and stream Shark Week 2026 free from anywhere. View Deal
Quick start: Using a VPN to watch Shark Week 2026 freeUsing a VPN is incredibly simple; just follow these steps.
1. Install the VPN of your choice. As we've said, Surfshark is the one we recommend.
2. Choose the location you wish to connect to in the VPN app. For instance if you're visiting the UK and want to view an American service, you'd select the "United States" location from the server list.
3. Sit back and enjoy the action. Head to your streaming platform of choice and watch Shark Week 2026 just like you would at home.
What to know about Shark Week 2026(All times ET/PT)
Sunday, July 26
8pm – K-Pop Shark Heroes
9pm – Air Jaws: Red, White and Breach
10pm – Invasion of the Mega Sharks
Monday, July 27
8pm – Bull Shark Dinner Bell
9pm – House of Sharks
10pm – Biggest Mako on Earth
Sunday, July 26
8pm – Jurassic Sharks
9pm – Jaws vs Orca
10pm – Chum Island: Catching a Killer
Sunday, July 26
8pm – Expedition X: Atomic Sharks
9pm – Expedition Unknown: Shark Secrets
10pm – Alien Sharks: Untamed America
Sunday, July 26
8pm – What Shark Attacked?
9pm – How to Train a Great White
10pm – Ultimate Shark Dive
Sunday, July 26
8pm – Secrets of the Great White Kill
9pm – Sharkzilla Takes New York
10pm – My Strange Shark Addiction
Sunday, July 26
8pm – Great White Highway
9pm – Thresher Shark: Stun to Kill
We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.