Plan
archived
Claude Cowork Sandbox Escape Lets AI Agent Read/Write Mac Files
- Engineer — Plan: A VM sandbox escape in Claude Cowork exposes the host Mac filesystem to the AI agent process; no KEV or public PoC yet, but the impact is high for any developer running this on a work machine. Check your Claude Cowork version and apply any available update; restrict the tool to non-sensitive environments until patched.
- SOC/IR — Learn: No active exploitation or IOCs reported, but this is a useful technique study: AI agent processes breaking out of containerized environments into host filesystems is an emerging attack class worth factoring into future detection logic for AI tooling on endpoints.
- Leader — Plan: With ~500,000 macOS users potentially affected, confirm whether Claude Cowork is in use on corporate machines and verify patch status with the vendor; this also warrants a policy checkpoint on which AI agent tools are approved for use on managed endpoints.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.