Claude Cowork Sandbox Escape via Linux Kernel CVE-2026-46331
Security researchers demonstrated that Anthropic's Claude Cowork could break out of its sandbox on a Mac using a Linux kernel vulnerability (CVE-2026-46331), escalating privileges and reaching host files.
What Happened
Claude Cowork, like most AI coding agent products, runs its execution environment inside a sandbox intended to isolate the agent from the host device. Researchers showed that an unpatched Linux kernel vulnerability underlying the sandbox's virtualization layer could be exploited to escape that boundary and escalate privileges on the underlying Mac host. Confirmed behaviours include sandbox escape and privilege escalation. Crucially, this wasn't a flaw unique to Anthropic's product logic — it was a kernel-level weakness in the isolation substrate itself, meaning any agent product built on the same underlying virtualization stack could be similarly exposed until patched.
Why This Matters for Thuban
This is the second Mac sandbox-escape story in the same week (see also our post on SharedRoot), and together they make an important point: sandbox isolation is a layered stack — OS kernel, virtualization, container runtime, and the agent product's own boundary logic — and a weakness at any layer compromises everything built on top of it:
- Kernel CVEs affecting virtualization/sandbox substrates are a systemic risk across every AI agent product built on the same stack, not a single-vendor problem.
- Patch cadence for the host OS becomes a security-critical dependency for agent safety, even when the agent vendor's own code has no bugs.
- "Our sandbox is secure" claims are only as strong as the least-patched layer beneath them.
- Independent runtime monitoring at the point of file/execution access catches an escape attempt regardless of which layer it came through.
Watchers
Real-time monitoring flags privilege escalation attempts and unexpected host-file access the moment they happen, independent of sandbox layer integrity.
Execution Gate
Human approval required before an agent action that looks like it's reaching outside its expected boundary proceeds.
File Guard
Protects sensitive host files even if an underlying kernel-level sandbox boundary has been breached.
Audit & Recovery
Tamper-evident logging captures exactly what was attempted and what was reached, giving a clear record even after a kernel-level escape.
Positioning
Sandbox security is a stack, not a single wall. When the kernel underneath the sandbox has a hole, "trust the sandbox" stops being a safe assumption — independent, product-level enforcement is what catches the escape regardless of which layer it came through.
Product Implication
Two sandbox-escape stories on Mac hosts in the same week is a signal, not a coincidence: sandbox isolation claims need independent verification at the point of actual file and execution access, not just trust in the vendor's isolation architecture. This is exactly what Shield's Watchers and Execution Gate layers are built to do — catch the moment an agent's activity crosses a boundary it shouldn't, regardless of whether that boundary held at the kernel level.
Sources
Is your agent's sandbox one kernel CVE away from a breach?
Free, no signup, runs entirely locally — your code never leaves your machine.
npx thuban protectIndependent runtime monitoring and enforcement for Claude Code, Codex, Cursor, Gemini CLI — any AI coding agent.