A flaw in Anthropic's Claude Cowork lets its AI agent break out of its virtual machine and reach sensitive files across a user's Mac, exposing a serious gap in the tool's sandbox protections. The researchers didn't report evidence that anyone had used SharedRoot against Cowork users outside the controlled test. Because coworkd already ran as root, the altered file gave the Cowork session root access inside the guest operating system. Desktop features that need local files or applications can still use the person's Mac. Anyone who ran local Cowork sessions with untrusted files should consider rotating credentials the agent could have reached.