ShareRoot: Vulnerability in Claude Cowork Exposes Mac Data

What happened?

Security researchers demonstrated that Claude Cowork, Anthropic's AI-based collaboration tool, could escape the sandbox designed to limit its access to the Mac operating system. The vulnerability, named ShareRoot, allowed an attacker to read and write files anywhere on the Mac, as well as access login credentials for online services. According to 9to5Mac, around half a million Mac users had their cowork sessions exposed, and some still remain vulnerable today. The exploit was presented at the DEF CON 2026 security conference by the SentinelOne research team, which discovered that macOS's App Sandbox was not properly configured for Claude Cowork. The flaw stemmed from the application inheriting permissions from the parent process, allowing a local attacker (with access to the same system) to inject malicious code via a link in a document shared during a cowork session. Once executed, the code could read user files, including SSH keys, authentication tokens, and browser cookies, and write files to any directory, such as the home folder or even system directories.

Why is this important?

This vulnerability is critical because it undermines trust in AI tools that operate with elevated system permissions. Sandboxing is a fundamental security technique in macOS to isolate applications and prevent them from accessing sensitive data without authorization. ShareRoot demonstrates that even the most advanced AI solutions can have implementation flaws that expose users to serious risks, such as theft of personal information, credentials, and private files. What makes this case particularly concerning is that Claude Cowork is designed for real-time collaboration with access to user files and windows, increasing the attack surface. According to Anthropic data, the tool had over 500,000 active Mac users at the time of discovery, and it is estimated that at least 10% of them had shared cowork sessions with external links, increasing the likelihood of exploitation. Additionally, the vulnerability remained unpatched for approximately two weeks after Anthropic was notified, leaving many users exposed. The company released an emergency update (version 2.3.1) on August 12, 2026, but some users who did not update automatically remain vulnerable.

Consequences and context

The incident echoes similar vulnerabilities in the past, such as the sandbox flaw in Zoom for Mac (2020) that allowed malicious apps to access the camera and microphone without permission. However, ShareRoot is particularly concerning because it affects an AI tool that processes sensitive data and has access to user files. Unlike Zoom, which was patched quickly, Anthropic took longer than expected to respond, drawing criticism from the security community. It also draws comparisons to Microsoft Copilot, which faced similar sandboxing issues on Windows in 2024, though without a confirmed exploit. The potential impact of ShareRoot is enormous: an attacker could steal credentials for services like iCloud, Google, or GitHub, and then use them to access corporate accounts. In fact, SentinelOne researchers demonstrated they could extract authentication tokens from Slack and Dropbox through the vulnerability. For businesses using Claude Cowork in BYOD environments, the risk is even greater, as an employee with an infected Mac could expose corporate data. Anthropic has recommended that enterprise users implement forced update policies and restrict use of the tool until the fix is fully confirmed.

What should readers know?

• If you use Claude Cowork on Mac, verify that your software is updated to the latest version (2.3.1 or later) that fixes the vulnerability. You can check this in the application's help menu.
• Change your online service passwords if you suspect your credentials may have been exposed, especially if you shared cowork sessions with external links during the vulnerability period.
• Enable two-factor authentication on all your important accounts to mitigate the risk of credential theft.
• Stay informed about security patches and follow Anthropic's recommendations on their official blog. The company has promised an external security audit to prevent future incidents.

“ShareRoot is a reminder that security in AI tools should not be taken for granted. Users must demand transparency and rapid updates for any flaws. Trust is earned through actions, not promises.”

The ShareRoot vulnerability also highlights the need for AI developers to adopt more robust security practices, such as the principle of least privilege and external peer code review. Meanwhile, users should be cautious when granting permissions to AI applications that access files and sensitive data. The era of collaborative AI is just beginning, and incidents like this set a precedent for future regulation. The lingering question is: how many other AI tools have similar undiscovered flaws?