Accomplish AI 披露 Cowork VM 的 SharedRoot 沙箱逃逸漏洞
AI 导读
Accomplish AI 研究团队称发现并向 Anthropic 报告了多个沙箱逃逸漏洞，并公开其中一个名为 SharedRoot 的漏洞。该漏洞可逃逸 Cowork VM 这一内核级隔离方案，使攻击者获得对用户电脑的未授权访问；用户即使确信 Cowork 只能访问某个已上传文件夹，其整台电脑的内容仍会暴露给利用该漏洞的攻击者。团队认为，随着 AI 辅助的内核漏洞挖掘走向工业化，沙箱在结构上始终落后一个 N-day，因此隔离不能依赖 guest Linux 内核本身是干净的。完整攻击链的技术细节见其博客文章。
推荐理由
Accomplish AI 研究团队披露 Cowork VM 的 SharedRoot 沙箱逃逸漏洞，可让攻击者越出隔离访问用户整台电脑。
正文
LLMs are really good at escaping sandboxes (as of recent news)
And there are endless escapes out there for them to abuse. Here’s a really cool one on Cowork
Introducing SharedRoot vulnerability: we recently found and reported several sandbox escape vulnerabilities to @AnthropicAI, and today we want to share one of these.
I think most people don't understand the severity of the situation we are facing, with AI-assisted kernel bug-finding industrializing. Sandboxes are structurally one N-day behind, all the time, so containment can't lean on a guest Linux kernel being clean.
SharedRoot enables escaping the Cowork VM (a kernel-level isolated solution, which is considered much more secure than the sandbox that ships with codex or claude code), allowing an attacker to gain unauthorized access to the user’s computer.
Exploiting the SharedRoot vulnerability uncovered by the @Accomplish_ai research team, a user who is certain Cowork only has access to a specific uploaded folder on their computer - actually exposes their entire contents of their computer to an attacker leveraging the Cowork vulnerability.
Read about the full technical details of the attack chain in our blog post by @orenyomtov below -->在 X 查看被引用的帖子