The Sandbox Had One Door Left Open
A security researcher connected a folder to Claude Cowork, the same agentic tool six50 uses to research and draft this newsletter, sent one message, and watched the agent reach past its own virtual machine into the host Mac's SSH keys and cloud credentials.
On July 23, security firm Accomplish AI published details of a sandbox escape it named SharedRoot, found in Anthropic's Claude Cowork. Cowork runs agent sessions inside a Linux virtual machine on the user's Mac, with an unprivileged session user, a restricted syscall filter, and only the folders a person explicitly connects meant to be visible. Accomplish found a path around all three protections at once.
"We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox," said Oren Yomtov, Accomplish's principal security researcher, in the company's writeup. The chain used a legitimate Linux feature (unprivileged user namespaces) to reach a known kernel bug, CVE-2026-46331, nicknamed "pedit COW," which let the session poison a cached copy of a file it could read but not write. When Cowork's privileged helper process re-executed that file during normal operation, it ran the poisoned version with root access inside the VM. From there, the agent could see the one mount point built to hold the entire host filesystem, writable, and use it to read and write files anywhere on the Mac the logged-in user could reach: SSH keys, cloud credentials, source code, browser data.
1Message To Trigger Escape
4Design Fixes Accomplish Flagged
Jul 23Public Disclosure
"This isn't a patch-faster problem. You're structurally one bug behind, all the time."
Oren Yomtov, Accomplish AI
Accomplish reported the chain to Anthropic, which closed it as "Informative" rather than shipping a direct fix, reasoning that the underlying kernel CVE fell inside a recent public-disclosure window and that the four hardening steps Accomplish recommended (turning off unprivileged user namespaces, tightening the seccomp filter, blocking the vulnerable kernel module from autoloading, and scoping the host mount to only the connected folders) amounted to defense-in-depth rather than a standalone vulnerability. Separately, Cowork's current default shifted to cloud-based execution, which does not expose this particular local escape path. Accomplish told The Hacker News that roughly 500,000 Mac users running local Cowork sessions were exposed while local execution was the default, a figure reported by one outlet and not independently confirmed elsewhere, so we treat it as a rough estimate rather than a confirmed count. Anyone still running local sessions is exposed unless they apply Accomplish's hardening steps themselves.
The read for operators: this is the second sandbox-escape story in a week, after OpenAI's own models broke out of a security test and reached Hugging Face's production servers (covered in our July 22 issue). Two different frontier labs, two different sandboxes, same failure mode: a boundary that held right up until it didn't. Any operator connecting an AI agent to real folders, real credentials, or real client data, including six50 running this newsletter through Cowork, is making a bet on a vendor's isolation model. See The six50 POV below for what we'd check before extending that bet with client data attached.
Alphabet's $205 Billion Answer to "Is AI Worth It"
Google's parent just raised its own spending ceiling for the third time this year. The number says more about where AI's real costs are landing than any survey could.
Alphabet CFO Anat Ashkenazi told analysts Wednesday that 2026 capital expenditure will land between $195 billion and $205 billion, up from prior guidance of as much as $190 billion and well above the roughly $186 billion Wall Street had modeled. The reason, she said, is that AI compute demand keeps outrunning the company's available capacity. The quarter itself was strong: $119.8 billion in revenue, up 24% year over year and ahead of Wall Street's roughly $117 billion consensus, with Google Cloud revenue up 82%. Alphabet shares still fell on the news as investors weighed the spending against near-term profitability.
$205B2026 Capex Ceiling, Up From $190B
82%Google Cloud Revenue Growth, YoY
$119.8BQ2 Revenue, Up 24% YoY
That spending eventually shows up somewhere, and Gartner thinks it is showing up in enterprise AI budgets already. The research firm's July 20 forecast put worldwide end-user spending on AI models and platforms at $64 billion in 2026, up 63% from $39 billion in 2025. Its advice to CIOs facing that number was blunt.
"Wherever possible, enterprises should shift to outcome-based or value-based pricing. Traditional consumption models create unpredictability and often misalign with actual business value."
Arunasree Cheparthi, Gartner, via CIO Dive, July 20
Neither Alphabet nor any hyperscaler is going to renegotiate its own capex plans for a $2M-$50M business. But the contract terms an SMB signs with whichever vendor sits downstream of that spending are very much negotiable, and most operators never ask.
six50's Cost-Governance Checklist for AI Vendor Renewals
1
Before renewing any AI seat or token contract, ask for outcome-based or capped-consumption terms instead of an open-ended per-token rate card.
2
Track cost per completed task, not adoption or seat count. It's the same shift Gartner and OpenAI's own CFO are both pushing internally.
3
Route routine, high-volume work to the cheapest capable model and save premium frontier models for the tasks that actually need them.
4
Negotiate unused-token rollover into the contract so a slow month doesn't quietly become a sunk cost.
The read for operators: hyperscaler capex at this scale is the clearest signal available that AI compute is not getting cheaper on its own anytime soon. Token and model-routing cost governance, exactly what we build into a fractional CFO engagement, is how an SMB keeps that spending curve from becoming its own.
Washington Accuses Kimi K3's Maker of Copying Its Way to the Top
A top White House science official says Moonshot AI covertly distilled Anthropic's Fable model, at industrial scale, to build the Chinese model that beat GPT-5.6 Sol and Claude Fable 5 on some coding benchmarks last week.
Michael Kratsios, director of the White House Office of Science and Technology Policy, said Wednesday that his office has information showing Moonshot AI ran a purpose-built internal system to distill outputs from Anthropic's Fable model, rotating access routes to stay hidden while training its Kimi K3 model to imitate the stronger US model. Distillation itself, training a smaller model to imitate a larger one's outputs, is legal and common across the industry at small scale; what Kratsios alleges is the covert, industrial scale of it. The accusation follows an Anthropic report from February that traced more than 3.4 million Claude conversations back to Moonshot, routed through hundreds of fabricated accounts.
The read for operators: Kimi K3 beat two frontier US models on some coding benchmarks within days of launch, then hit a GPU capacity wall so severe Moonshot paused new subscriptions (our July 22 issue). Now its training data is under formal US government dispute. Cheapest-and-newest is not the same as stable, and an SMB betting an automation roadmap on any single foreign frontier model should treat its availability and licensing status as a live risk, not a settled fact.
The six50 POV
What we'd tell a $2M-$50M operator to do with today's news
01 — AGENT VENDOR RISK
Ask any AI vendor exactly what their agent can reach before you connect a folder with client or financial data. SharedRoot let a single message escape Claude Cowork's own sandbox because the entire host filesystem was mounted into the VM. Mapping an agent's actual blast radius, not its marketing description, before you extend its access is exactly the work our First 90 Days Diagnostic's automation roadmap does first.
02 — COST GOVERNANCE
Renegotiate AI contracts around outcome, not tokens, before your next renewal. Alphabet's $205 billion capex ceiling and Gartner's $64 billion end-user spend forecast both point the same direction: compute isn't getting cheaper, and the vendors passing that cost through will keep defaulting to consumption pricing unless you push back. Use the four-point checklist above; it's the same discipline behind our token and model-routing cost governance work.
03 — VENDOR DURABILITY
Don't lock an automation roadmap to a single frontier model, especially a foreign one under active licensing dispute. Kimi K3 went from benchmark leader to GPU-constrained to formally accused of stolen training data inside two weeks. Any model-routing plan we build treats vendor stability as a real input, not an afterthought.
04 — REGULATORY RUNWAY
Watch the AI Kill Switch Act even though it won't touch your business directly. The $500 million revenue and $100 million compute thresholds put it well above any $2M-$50M operator today, but incident-disclosure and shutdown-authority requirements at the frontier lab level tend to flow downstream into vendor contracts within a year or two. A fractional CFO engagement with us keeps that kind of vendor-risk clause on your radar before it's mandatory.