Anthropic Claude Cowork VM Escape: macOS Detection and Hardening Guide

---
title: Claude Cowork Suspicious Shell Spawning on macOS
id: 8f4a2c1e-9b3d-4a5e-8f6d-1c2b3a4c5d6e
status: experimental
description: Detects the Claude Cowork application spawning a shell (bash/zsh), indicating potential command execution on the macOS host.
references:
  - https://thehackernews.com/2026/07/claude-cowork-flaw-could-let-ai-agent.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|contains: 'Claude'
    Image|endswith:
      - '/bash'
      - '/zsh'
      - '/sh'
  condition: selection
falsepositives:
  - Legitimate developer debugging (rare)
level: high
---
title: Claude Cowork Accessing Sensitive User Directories
id: 9e5b3d2f-0c4e-5b6f-9g7e-2d3c4b5e6f7g
status: experimental
description: Detects Claude Cowork processes accessing sensitive directories like .ssh or .aws, indicative of a VM escape or data exfiltration attempt.
references:
  - https://thehackernews.com/2026/07/claude-cowork-flaw-could-let-ai-agent.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: file_access
  product: macos
detection:
  selection:
    Image|contains: 'Claude'
    TargetFilename|contains:
      - '/.ssh/'
      - '/.aws/'
      - '/.kube/'
  condition: selection
falsepositives:
  - User explicitly granting access to these folders for legitimate AI tasks
level: high

// Hunt for Claude Cowork processes interacting with sensitive file paths
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName contains "Claude" 
| where ProcessCommandLine has "/.ssh/" 
   or ProcessCommandLine has "/.aws/" 
   or ProcessCommandLine has "/etc/" 
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

-- Hunt for Claude processes accessing files outside of standard user directories
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name =~ 'Claude'
   AND (CommandLine =~ '/etc/' OR CommandLine =~ '/.ssh/' OR CommandLine =~ '/.aws/')

#!/bin/bash

# Claude Cowork Hardening Script for macOS
# This script checks for the presence of the app and attempts to quarantine it if an update is not available.

APP_NAME="Claude.app"
APP_PATH="/Applications/$APP_NAME"
QUARANTINE_ATTR="com.apple.quarantine"

if [ -d "$APP_PATH" ]; then
    echo "[+] Claude Cowork found at $APP_PATH"
    
    # Check if the app is currently running
    if pgrep -f "$APP_NAME" > /dev/null; then
        echo "[!] WARNING: Claude Cowork is currently running. Please quit the application before proceeding."
        exit 1
    fi

    echo "[*] Checking for updates via Homebrew (Cask) or manual intervention required..."
    # Note: Automated updating is discouraged to prevent version drift. 
    # Administrators should verify the latest patched version from Anthropic.

    echo "[!] ACTION REQUIRED: Verify patch status for the VM Escape vulnerability."
    echo "[!] If no patch is available, restrict Full Disk Access in System Settings."

    # Optional: Quarantine the app to prevent execution until patched (Uncomment below to enforce)
    # xattr -w "$QUARANTINE_ATTR" "0181;$(date +%Y-%m-%d);Security Arsenal; Anthropic Claude Cowork Quarantine" "$APP_PATH"
    # echo "[+] App has been quarantined."

else
    echo "[-] Claude Cowork not found in /Applications."
fi