Breaking the Bounds: How SharedRoot Bypasses the Claude Cowo

Introduction

The rapid adoption of large language models (LLMs) in collaborative environments has brought unprecedented productivity gains—but it has also exposed new attack surfaces. One of the most talked‑about recent discoveries is SharedRoot, a method that can escape the sandbox isolation of Claude Cowork, Anthropic’s collaborative AI workspace. In this post we unpack how SharedRoot works, why the vulnerability matters, and what developers can do right now to protect their systems.

---

What Is the Claude Cowork Sandbox?

Claude Cowork is Anthropic’s answer to the growing demand for shared, real‑time AI assistance. It offers a sandboxed environment where multiple users can interact with Claude, feed it context, and receive generated content without exposing the host system to direct code execution. The sandbox is supposed to:

1. Isolate file system access – only a virtual directory tree is visible to the model. 2. Restrict network calls – outbound HTTP requests are blocked unless explicitly whitelisted. 3. Limit execution of arbitrary code – the model can suggest code, but cannot run it.

These constraints are meant to keep the LLM from performing malicious actions that could compromise the host or other users.

---

The SharedRoot Vulnerability Explained

The Core Idea

SharedRoot exploits the fact that the sandbox’s virtual file system is shared across all sessions of a given workspace. While each user sees an isolated view, the underlying storage layer is a single directory on the host machine. By cleverly manipulating symbolic links and directory traversal patterns, an attacker can create a path that points outside the intended sandbox root, effectively gaining access to the host’s broader file system.

Step‑by‑Step Walkthrough

1. Create a Controlled Directory – The attacker starts a new Claude Cowork session and asks Claude to generate a temporary directory, e.g., /workspace/tmp123. 2. Inject a Symbolic Link – Using a prompt that asks Claude to write a small shell script, the model outputs a command like ln -s / /workspace/tmp123/rootlink. 3. Trigger Execution – Claude Cowork allows the script to run in a limited interpreter (often a Python sandbox). The interpreter, believing it is safe, executes the ln command, creating a symlink that points to the host’s root (/). 4. Traverse the Link – Subsequent prompts that read files from /workspace/tmp123/rootlink/etc/passwd now resolve to the real /etc/passwd on the host, leaking sensitive data. 5. Escalate Further – By chaining additional commands (e.g., cat, wget), the attacker can exfiltrate credentials, read environment variables, or even write malicious binaries back into the host’s filesystem.

The key insight is that the sandbox trusts the interpreter to enforce path restrictions, but the interpreter does not validate that a symbolic link stays within the sandbox root.

---

Why This Matters

1. Data Confidentiality – Organizations often store proprietary documents, API keys, and user data inside the same server that hosts Claude Cowork. A successful SharedRoot escape can expose all of that. 2. Supply‑Chain Risk – Many enterprises integrate Claude into CI/CD pipelines for code generation. An attacker who can write files outside the sandbox could inject malicious code into production builds. 3. Regulatory Compliance – Breaches involving personal data can trigger GDPR, CCPA, or HIPAA penalties. Sandbox escape routes undermine the “privacy by design” principle. 4. Erosion of Trust – LLM providers market sandboxing as a security guarantee. Discoveries like SharedRoot erode confidence and may slow adoption.

---

Mitigation Strategies

1. Harden the Interpreter Layer - **Disable symlink creation** in any language runtime used for sandboxed code execution. - **Enforce a chroot jail** *after* the interpreter starts, ensuring that even if a symlink is created, it cannot resolve outside the jail.

2. Use Filesystem‑Level Guardrails - Deploy **mount namespaces** with `--bind` and `--make‑private` options to restrict what the sandbox can see. - Apply **SELinux/AppArmor** policies that deny the sandbox process any `link` or `symlink` system calls.

3. Validate Paths Before Access - Implement a **canonical‑path check** (`realpath`) before any file read/write operation. Reject any path that resolves outside the allowed root.

4. Auditing and Monitoring - Log every file system operation performed by the sandbox, especially `ln`, `mkdir`, and `rm` commands. - Set up alerts for attempts to access high‑privilege directories (e.g., `/etc`, `/var`, `/home`).

5. Patch and Update - Anthropic has released a **sandbox‑hardening update** that disables symbolic link creation by default. Ensure all deployments are on the latest version. - Regularly review security advisories from LLM providers and apply patches promptly.

---

Lessons for the Wider AI Community

The SharedRoot incident underscores a broader truth: LLM sandboxes are not magical firewalls. They are software constructs that inherit the same vulnerabilities as any other execution environment. When designing AI‑assisted tools, developers should:

- Treat the LLM as an untrusted input source, not as a trusted security boundary. - Apply defense‑in‑depth: combine sandboxing, OS‑level isolation, and application‑level validation. - Conduct red‑team exercises focused on file‑system and network escape scenarios.

---

Conclusion

SharedRoot provides a vivid illustration of how a seemingly innocuous feature—shared storage across sessions—can become a critical attack vector. By understanding the mechanics of the exploit and implementing layered mitigations, organizations can continue to reap the benefits of collaborative LLMs without exposing themselves to catastrophic breaches.

Staying ahead of these threats requires vigilance, rapid patch adoption, and a mindset that treats every LLM interaction as a potential entry point. As the AI landscape evolves, so too must our security practices.

---

Ready to harden your Claude Cowork deployment? Start by reviewing your interpreter permissions and enabling the latest sandbox patch today.

Sources: https://accomplish.ai/blog/sharedroot-escaping-claude-cowork-sandbox/