September 14, 2026
- CVE-2026-46331 breaks Claude Cowork’s local-VM boundary. Accomplish.ai published a technical write-up demonstrating an escape from Claude Cowork’s local sandbox. This is a public research demonstration, not a report of exploitation in the wild. For agent deployments, it makes the local VM a boundary to validate rather than an assumed containment layer around untrusted workspace content and tool execution. · Vulnerabilities & Exploit Research