Why it matters
Accomplish AI demonstrates SharedRoot, a Claude Cowork local-session escape in which an untrusted task reaches guest root through CVE-2026-46331 and then accesses the Mac host because the entire host filesystem is mounted read-write inside the VM. The durable failure is architectural—unprivileged user namespaces, reachable kernel modules, a permissive seccomp filter, an unhardened root broker, and an over-broad host mount—rather than the single kernel bug; Cowork now defaults to cloud execution.
My takeaway: Agent sandboxes should assume recurring guest-kernel privilege escalation. Disable unnecessary namespaces and module autoloading, narrow system calls, harden broker processes, and expose only explicitly granted folders—preferably read-only—so guest root still cannot reach host credentials.