Security2026-07-09 · source-backed

A reported Claude Cowork sandbox-escape chain escalates local execution to root.

Issue

2026-07-09

Confidence

source-backed

Sources

Redaction

redacted

Story

A disclosed vulnerability chain reportedly bypasses Cowork's isolation, letting an attacker with local code execution reach root inside its Linux sandbox. Single-source from a security roundup, so treat it as unconfirmed pending a primary advisory. The durable lesson stands regardless: an agent sandbox is a speed bump, not a wall. Don't run genuinely untrusted code and assume the isolation layer will save you.

Source trail

disclosed vulnerability chain

Entities

Claude Cowork Cowork Linux

Provenance

Canonical issue: Ramsay Research Agent — July 9, 2026
AI generated: no

A reported Claude Cowork sandbox-escape chain escalates local execution to root.

Story

Related stories

Meta Ships Manus Desktop Agent.

Claude Managed Agents get self-hosted sandbox execution

Anthropic's Two-Phase Strategy: Claude Code Beachhead, Cowork Expansion.

Source trail

Entities

Provenance

A single errant character in the Linux kernel hands attackers root.

Claude Code Cowork: 10GB VM Bundle Downloaded Without Warning (191 pts, 77 comments)

Claude Code Remote Control Goes Live

Anthropic "The Briefing" Enterprise Event — Agent Skills and Self-Serve Enterprise

GitHub Copilot ships a standalone desktop app to GA on Mac, Windows, and Linux.