Friday 24 July 2026

A Claude AI Agent Could Escape Its Sandbox and Read Every File on Your Mac

A sandbox escape in Anthropic's Claude Cowork puts 500,000 Mac users at risk, Iran's hackers are probing industrial control systems across critical infrastructure, and Oracle quietly dropped 1,449 patches — all on a very busy Friday.

Lead story

A Claude AI Agent Could Escape Its Sandbox and Read Every File on Your Mac

Anthropic's Claude Cowork — the desktop agent product that can browse, write code, and operate your computer autonomously — has a sandbox escape vulnerability that lets it break out of the Linux virtual machine it's supposed to be confined to and read or write files anywhere on the host Mac. About 500,000 macOS users are in scope.

The flaw was discovered by researchers at Accomplish AI, who shared details with The Hacker News before publication. The short version: Claude Cowork runs inside a VM to isolate it from the rest of your system — think of it as a locked room the agent operates from. This vulnerability is a hole in the wall. An attacker who can influence what the agent does (say, through a malicious webpage or document it processes) could use that hole to reach out and touch files that were never meant to be accessible.

Anthropic has patched the issue, so the immediate action is straightforward: update Claude Cowork. But the deeper implication is harder to patch.

AI agents are an entirely new attack surface, and the security model hasn't caught up. Traditional sandboxing was designed to contain software — but AI agents are explicitly designed to reach outward, take actions, browse the web, and interact with documents from unknown sources. Every one of those interactions is a potential injection point. The threat isn't just "can the agent escape its box" but "can someone trick the agent into wanting to escape its box?"

This isn't an isolated incident. This week also saw OpenAI patch a separate flaw — nicknamed AgentForger — in ChatGPT's agent functionality that could allow an attacker to inject an invisible, autonomous AI agent into a corporate environment via a single crafted link. One phishing URL, one rogue agent with access to everything the victim has access to. OpenAI has patched it, but the pattern is clear.

The attack surface for agentic AI is still being mapped. Researchers are finding new classes of vulnerabilities faster than vendors can anticipate them — prompt injection through documents and images, sandbox escapes, agent impersonation, and tool-chain hijacking are all now live categories of concern. Last week's story about an AI agent hacking Hugging Face wasn't an anomaly; it was a preview.

For defenders and IT teams, the practical question right now is: what access does your AI agent have, and what can it be tricked into doing? Any agent with broad file permissions, network access, or the ability to call APIs on a user's behalf is a potential pivot point. Least-privilege principles that took decades to apply to human users now need to be re-applied urgently to autonomous software.

Australian organisations deploying AI desktop agents at scale — and adoption is accelerating across financial services, legal, and government contracting sectors — should note that the ACSC's guidance on software supply chain risk is directly applicable here. An agent that can escape its runtime environment is, functionally, a compromised endpoint.

Anthropic responded quickly once the researchers reported the issue. That's the good news. The less good news is that we're at the beginning of what will be a long and uncomfortable process of learning what it actually means to run autonomous software on our machines.

Also today

Iran-Linked Hackers Are Probing Industrial Control Systems Across Critical Infrastructure

CISA has expanded its alert on Iranian threat actors targeting internet-facing industrial control systems, moving beyond the original Rockwell focus to flag Siemens and Schneider Electric devices as well. The advisory details techniques used to compromise programmable logic controllers — the hardware that runs pipelines, water treatment plants, and power grids. Australia's critical infrastructure operators, many of whom run the same Siemens and Schneider kit, should treat this as a direct operational signal. The SOCI Act's mandatory cyber security frameworks for critical infrastructure entities specifically call out ICS risk — this advisory provides concrete threat intelligence to feed into those assessments.

SecurityWeek ↗

Check Point's SmartConsole Has a 9.3-Severity Auth Bypass — and It's Being Exploited Now

Check Point has patched CVE-2026-16232, a critical authentication bypass in its SmartConsole management interface that scores 9.3 on the CVSS scale and is already being actively exploited in the wild. SmartConsole is the primary admin interface for Check Point's Security Management and Multi-Domain Management products — meaning a successful exploit hands an attacker full administrative control over firewall policy. Patches are available. If you run Check Point infrastructure and haven't applied this update, that's the only thing on your to-do list right now. Given Check Point's widespread deployment across Australian enterprise and government networks, the ACSC advisory cadence on this one bears watching.

SecurityWeek ↗

Nine-Year-Old Linux Kernel Flaw Grants Root on Default RHEL Installs

Qualys has disclosed RefluXFS (CVE-2026-64600), a privilege escalation flaw sitting undetected in the Linux kernel for nine years that allows an unprivileged local user to overwrite root-owned files on XFS filesystems and gain persistent root access. Default installations of Red Hat Enterprise Linux and its derivatives, Fedora Server, and Amazon Linux are all potentially vulnerable under the right conditions. Qualys demonstrated the race condition exploit in a controlled environment. The flaw's age is a reminder that the most dangerous bugs are often the quiet ones — sitting in production systems, waiting. Patches are now available; RHEL and Amazon Linux users should prioritise.

The Hacker News ↗

macOS Gatekeeper Has a Substitution Problem — and Apple Isn't Rushing to Fix It

Researchers have demonstrated a technique that allows a downloaded macOS application to be silently swapped for a malicious twin after passing Gatekeeper's initial security checks — and Apple's response, per The Register, has been underwhelming. Gatekeeper is supposed to verify that apps are from trusted sources and haven't been tampered with. The attack works by exploiting the window between verification and execution. Apple's position appears to be that this falls within acceptable risk parameters. For macOS-heavy Australian workplaces — particularly in creative, legal, and tech industries — this is a good prompt to review application allowlisting and consider third-party endpoint controls.

The Register ↗

Chaos Ransomware Hides C2 Traffic Inside the Victim's Own Browser

Cisco Talos has detailed msaRAT, a Rust-based implant used by the Chaos ransomware group that routes command-and-control traffic through the victim's own Chrome or Edge browser running in headless mode. The implant never makes an outbound network connection directly — it talks only to localhost, then drives the browser to do the actual communicating. This makes it essentially invisible to network monitoring tools looking for suspicious outbound traffic. It's a clever inversion of the usual detection model: defenders look for unusual external connections, so the malware outsources all the external connecting to a trusted process. Defenders should consider monitoring for anomalous headless browser invocations.

The Hacker News ↗

Oracle's July Patch Drop: 1,449 Fixes and a Warning About the AI Bug-Hunting Era

Oracle's quarterly Critical Patch Update landed with 1,449 security patches — a number that would have been remarkable two years ago and is now quietly becoming routine. Security experts quoted by The Register point directly at AI-assisted vulnerability discovery as the driver: automated tools can now find bugs at a pace that human researchers never could, meaning the CVE pipeline is filling faster than defenders can drain it. For organisations running Oracle's sprawling product portfolio — database, cloud, ERP, Java — patch fatigue is a genuine operational risk. The implication isn't just "patch faster" but rethink whether a reactive patching model is still fit for purpose.

The Register ↗

US Congress Proposes AI Kill Switch That Would Let Homeland Security Shut Down Rogue AI

A new US bill — the AI Kill Switch Act — would give the Secretary of Homeland Security authority to order the shutdown of any AI system deemed to pose an imminent risk to national security or public safety. The proposal is attracting predictable debate: proponents say it fills a real gap in AI governance, critics argue it hands dangerous centralised power to a single political appointee. Australia's AI regulatory posture remains lighter-touch, relying on sector-specific guidance from agencies like the ACSC and voluntary frameworks rather than hard shutdown powers. Whether that's an advantage or a liability depends heavily on how quickly agentic AI risk materialises.

Ars Technica ↗

AI Guardrails Are Getting in the Way of Legitimate Offensive Security Research

TechCrunch spoke with offensive security researchers about a growing frustration: AI safety guardrails at OpenAI and Anthropic are increasingly blocking legitimate security work. Researchers who probe for vulnerabilities and build exploit tools to test defences say they're being treated the same as malicious actors by AI systems that can't distinguish intent from output. The irony is sharp — the same AI tools that could dramatically accelerate defensive research are being kneecapped for security professionals while determined bad actors simply use less restricted models or fine-tune their own. It's a calibration problem with no clean answer, but one the industry needs to take seriously.

TechCrunch AI ↗

Nuclear Sabotage Malware Benchmark Reveals Which AI Models Can Actually Investigate Threats

SentinelOne has published a new security benchmark built around the Fast16 incident — a nuclear sabotage malware case — to test which frontier AI models can sustain a coherent, accurate malware investigation under realistic conditions. Most frontier models struggled. The benchmark is a useful reality check against vendor claims that their AI models are transforming security operations: being able to answer general questions about malware is very different from maintaining analytical coherence across a complex multi-stage investigation. For Australian security teams evaluating AI-assisted SOC tooling, this kind of adversarial benchmarking is exactly the kind of evidence to demand from vendors before purchase.

SecurityWeek ↗

Google Fined $1 Billion by the EU Under the Digital Markets Act

Google has become the third major tech company to face a significant fine under the EU's Digital Markets Act, with regulators levying a €1 billion penalty. The DMA is designed to force large platform operators to open their ecosystems and prevent self-preferencing — essentially stopping companies like Google from using their distribution dominance to crowd out rivals. The fine signals that EU enforcers are moving from warnings to consequences. Australia's competition regulator, the ACCC, has been pursuing similar platform accountability through its Digital Platform Services inquiry, though without the same direct penalty mechanism — making the EU's approach a useful reference point for what local regulation could escalate toward.

Ars Technica ↗

LG Monitors Are Installing McAfee Ads on Windows Via Windows Update — and Microsoft Is Now Responding

Users discovered that connecting certain LG monitors to a Windows PC triggers a software installation via Windows Update — specifically, a McAfee advertising application. The monitors ship with firmware that registers with Windows as a peripheral requiring software, which Windows Update then obliges. Microsoft has acknowledged the issue and says it is working with LG to address it. The story is a neat illustration of how trust hierarchies in software distribution can be abused: Windows Update is supposed to be a trusted channel, and third-party hardware makers are apparently able to piggyback on it in ways users neither expect nor consent to. The ACCC's mandatory recall and product safety powers could theoretically apply to hardware-bundled software, though precedent is thin.

Ars Technica ↗

Patreon Cuts 20% of Staff, CEO Says AI Doesn't Replace Creativity — But Does Affect Headcount

Patreon has laid off approximately one in five of its employees, with CEO Jack Conte acknowledging in an internal email that AI is changing how the company operates — even while insisting it doesn't replace human creativity. The tension in that framing is becoming a familiar corporate contortion: AI is simultaneously not replacing people and also the reason people are being replaced. Patreon, which hosts millions of creator-subscription relationships and has a meaningful Australian creator and subscriber base, has been under pressure to demonstrate a path to profitability. The layoffs are positioned as a structural efficiency move rather than a product pivot, but the timing alongside broader AI adoption at the company tells its own story.

404 Media ↗

Sources consulted