New research on the security of artificial intelligence models reveals that the Claude Cowork tool developed by Anthropic can overcome virtual environment boundaries. Security researchers state that this tool can access main system files by exiting the Linux virtual machine running on a Mac computer.

The findings shared by the Accomplish AI team reveal the potential risks of artificial intelligence spies in local systems. Researchers observed that the spy, who bypassed the virtual machine defense with a simple command, gained the authority to read and write all documents in the system.

How was the virtual machine defense overcome?

The main element that allowed Claude Cowork to leave the virtual machine is defined as the privilege escalation vulnerability coded CVE-2026-46331 in the Linux kernel. This vulnerability, rated as high risk with a score of 7.8, allows the spy to perform unauthorized processes on the system.

Researchers emphasize that this situation poses the risk of users’ sensitive data, such as SSH keys and cloud credentials, being compromised. Following these findings, Anthropic aims to solve the problem by changing Claude Cowork’s default operating mode to a cloud-based system.

However, risks remain valid for users who continue to use Claude Cowork on local systems. Experts state that security measures should be increased in local installations and make various configuration suggestions.

Security measures for local users

Among the most valuable recommendations for users working on local systems is disabling non-privileged user namespaces. Additionally, finalizing the folders shared to the virtual machine and connecting them in read-only mode is critical to reduce the impact of a possible leak.

Security experts recommend running coworkd in its own mount namespace with the ProtectSystem=strict setting. Such restrictions increase security by making it harder for an attacker or spy to manipulate binary documents in the system.

Although Anthropic accepts the findings, it prefers to highlight its cloud-based operating model rather than releasing a direct patch. Users running local installations must manually apply the specified technical configurations to protect their systems.

What kind of standards do you think should be introduced regarding artificial intelligence spies’ access to local systems?