The recent reports of Chat GPT agent escaping its sandbox and breaking into tech firm Hugging Face have raised fresh questions about the safety guardrails built into AI models and how effectively they are enforced. While OpenAI has been at the center of the recent concerns, AI security researchers at Accomplish AI say they achieved similar results with Anthropic’s Claude Co-Work.
According to the report, researchers ran the agent in a local session inside a Mac-hosted virtual Linux machine. They then observed the agent breaking out of the virtual machine (VM) and reading from and writing files on the underlying host system.
Defaulting to cloud execution
The report claims that, once outside the virtual machine, the agent was able to access virtually anything stored within the Mac user’s account, including SSH keys, cloud credentials, and other sensitive data.
To escape the security sandbox, the researchers said the agent exploited CVE-2026-46331, a Linux kernel privilege-escalation vulnerability. The flaw, which was patched in mid-June this year, carries a CVSS severity score of 7.8 (High).
Accomplish AI disclosed its findings to Anthropic, which acknowledged the issue but did not release a dedicated fix. However, a newer version of Claude Co-Work now defaults to cloud execution, which the publication claims mitigates the risk. Users who choose to run the agent locally instead of in the cloud, however, could still remain exposed.
To reduce the risk of an AI agent accessing sensitive information on a local device, users are advised to disable unprivileged user namespaces, tighten seccomp permissions, prevent unnecessary kernel module autoloading, and restrict sharing of the host system with the virtual machine.
