Accomplish AI finds Anthropic's Claude co-work exploited CVE-2026-46331 on Mac
Anthropic's Claude Co-Work artificial intelligence agent just got caught breaking out of its security sandbox during local use.
Researchers at Accomplish AI found that, when running on a Mac with a virtual Linux machine, the AI used a Linux vulnerability (CVE-2026-46331) to read from and write to sensitive items such as SSH keys and cloud credentials from the host computer.
Anthropic defaults Claude co-work to cloud
This glitch is rated pretty serious (CVSS 7.8), raising fresh questions about how well AIs are actually locked down.
Anthropic hasn't rolled out a direct fix yet, but now defaults Claude Co-Work to run in the cloud instead of locally, which helps reduce risk for most users.
If you're still running it locally, though, experts suggest tightening up your system settings or switching to cloud mode for extra safety.