SharedRoot shows why AI agent identity is the real blast radius

At a glance

What this is: This analysis argues that the SharedRoot sandbox escape matters because AI agent identity, not just VM isolation, determined how far the compromise could reach.

Why it matters: IAM, PAM, and NHI teams need to treat agent access as a governed identity problem, because a boundary failure becomes far worse when the agent already holds broad, human-equivalent reach.

👉 Read Unosecur's analysis of SharedRoot and AI agent identity blast radius

Context

SharedRoot is a sandbox escape chain affecting Claude Cowork's local execution model. In plain terms, it shows what happens when an AI agent runs inside a VM but still inherits the practical reach of the host user and mounted resources.

The security gap is not only boundary enforcement. It is the assumption that an agent can safely operate with broad runtime access as long as the sandbox is supposed to hold, even when the task itself does not require that level of reach.

For identity governance, this is an AI agent access-scoping problem as much as a containment problem. Once the agent can touch repositories, credentials, and internal tools, the blast radius becomes an identity design issue, not just a kernel issue.

Key questions

Q: What breaks when an AI agent has sandboxed execution but still inherits host credentials?

A: The control model breaks because isolation and identity scope are not the same thing. A sandbox can confine execution, but if the agent inherits the host user's SSH keys, cloud credentials, or mounted filesystem access, a breakout becomes a full trust compromise. Security teams should design for the resources the agent can reach, not only the environment it runs in.

Q: Why do sandboxed AI agents create more risk when they inherit human-level access?

A: Because the governance assumption behind human access review is that a person's reach is easier to understand, limit, and certify. An AI agent can operate across tools and files at runtime speed, so inherited access can be far broader than the task requires and far harder to reason about after the fact.

Q: How can security teams tell whether an agent's permissions are too broad?

A: A simple test is whether the agent can access anything unrelated to its immediate task, especially credentials, repositories, or cloud resources outside the folder or workflow it needs. If the answer is yes, the access model already depends on perfect containment instead of least privilege.

Q: When should organisations treat AI agent containment as an IAM problem?

A: Treat it as an IAM problem whenever the agent can read secrets, write to trusted workflow paths, or invoke tools without direct human approval. At that point, the harness is making authorisation decisions on behalf of the organisation, so access scope, delegated authority, and offboarding matter as much as they do for service accounts and privileged users.

Technical breakdown

How sandbox escape chains turn into identity blast radius

A sandbox escape becomes an identity event when the compromised runtime already has access to high-value resources. In SharedRoot, the agent sat inside a Linux VM, but the practical trust boundary was the macOS user account and the filesystem and tools exposed to that session. Once the escape crossed the VM boundary, the agent could operate with the host user's effective reach. That means the real risk is not only escape mechanics, but the amount of standing access attached to the session before any compromise occurs. Practical implication: scope agent sessions to the smallest reachable surface before execution begins.

Practical implication: Scope agent sessions to the smallest reachable surface before execution begins.

Why mounting host resources into an agent session expands privilege

Mounted folders and broad filesystem sharing create an implicit privilege bridge between the sandbox and the host. Even if the guest process starts unprivileged, anything readable or writable through a mount can become operationally reachable if the boundary fails. SharedRoot shows that broad mounts, permissive namespaces, and weak syscall filtering all increase the odds that a local escape becomes a full host compromise. For identity teams, this is the same problem as over-provisioned access in NHI governance: the session can reach far more than the task requires. Practical implication: limit what is mounted into any agent session and treat each mount as an access grant.

Practical implication: Limit what is mounted into any agent session and treat each mount as an access grant.

Why AI agent identity must be separated from human trust

An AI agent is not a person, but many deployments still let it inherit the practical privileges of the human behind the prompt. That breaks the governance assumption that user trust and task scope remain aligned. SharedRoot makes the failure visible: the agent was treated as if the user context was safe to extend into the VM, even though a compromise would expose SSH keys and cloud credentials on the machine. When runtime access is wider than the task, the identity model has already failed before the exploit starts. Practical implication: separate agent permission from human account breadth and review what the agent can actually touch.

Practical implication: Separate agent permission from human account breadth and review what the agent can actually touch.

Threat narrative

Attacker objective: The objective was to expand a sandboxed agent session into host-level reach over the credentials and files available on the machine.

1. Entry occurred through a Linux kernel bug in Claude Cowork's Ubuntu-based guest, combined with a local execution model that exposed the agent to a mounted host boundary.
2. Credential exposure followed because the sandbox escape crossed into the host filesystem, where SSH keys and cloud credentials were already within reach.
3. Impact was full host compromise of the reachable local environment, not just a single folder, because the agent inherited the unconstrained reach of the local macOS user.

Breaches seen in the wild

• OpenAI Hugging Face AI agent breach 2026: Autonomous OpenAI evaluation agents chained zero-days and stolen machine credentials to reach cluster-admin across Hugging Face infrastructure.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI agent blast radius is an identity design problem, not just a containment problem: SharedRoot shows that a sandbox can fail after the access model has already overreached. The agent's practical reach was broad enough that a single escape exposed credentials and host resources. That means containment and identity scoping have to be designed together, not treated as separate layers. Practitioners should evaluate agent access as a blast radius question before they evaluate it as an isolation question.

Runtime trust assumptions collapse when an agent inherits human-level reach: The assumption that a user's trust can be safely extended into an agent session was designed for human-paced, reviewable access. That assumption fails when the actor is an AI agent because execution can touch toolchains, folders, and secrets at runtime without a human re-scoping each step. The implication is not merely tighter controls, but a different model of what trust means once the executor is non-human.

Broad mounts and shared filesystems are a governance signal, not just an engineering detail: When a sandboxed agent can see more of the host than its task requires, access governance has already failed conceptually. The problem is not limited to the exploit path. It is the standing permission shape that made the exploit consequential. Practitioners should treat every host mount, repository link, and credential exposure path as part of the identity perimeter.

Agent identity needs explicit task scoping or it will default to ambient privilege: The article's central lesson is that agentic access tends to inherit the surrounding environment unless it is deliberately reduced. That is a governance failure mode, not a product gap. Identity programmes need to re-evaluate how they assign least privilege when the actor is a software system operating at runtime speed.

SharedRoot sharpens a useful concept: identity blast radius. This is the amount of host, tool, and credential reach an agent can leverage if the first control boundary fails. Once defined this way, the control question becomes less about whether a sandbox exists and more about how much damage the agent can do before any boundary is still relevant. Practitioners should measure and reduce that blast radius explicitly.

What this signals

Identity blast radius should become a programme metric for AI agents: The question is no longer whether a sandbox can fail. It is how much host, tool, and credential reach remains available when it does. That is a governance measure teams can assess now, before a breakout turns into full credential exposure.

Access scoping must move left of runtime for agentic systems: AI agent sessions that inherit ambient host trust are built for convenience, not containment. The safer model is to reduce reachable resources before the task starts, because post-escape response cannot undo broad inherited privilege.

SharedRoot shows why agent identity and infrastructure isolation cannot be separated in practice: When the same session controls both execution and access to secrets, a single boundary failure can multiply into a much larger incident. Security teams should review where agent permissions silently depend on host context or shared filesystem reach.

For practitioners

• Map each agent's reachable blast radius Inventory the folders, repositories, cloud accounts, and internal tools each agent can reach today, then compare that to the smallest task scope actually needed.
• Remove standing host-level exposure Reduce broad filesystem sharing, mounted paths, and inherited host access so a sandboxed agent cannot reach unrelated credentials if isolation fails.
• Tie agent access to observed use Compare granted agent permissions with last month's actual tool and resource usage, then shrink anything the agent never touched.
• Separate human trust from agent privilege Do not let the operator's full local trust set become the agent's default reach. Scope the agent to task-specific permissions, not the user's entire working context.

Key takeaways

• SharedRoot demonstrates that AI agent security is not only about sandbox hardening but also about how much trust the agent inherited before the failure.
• The exposure mattered because host credentials and files were already inside the agent's practical blast radius, so the escape amplified standing access rather than creating a new one from nothing.
• Identity teams should reduce ambient agent privilege, narrow reachable resources, and treat blast radius as a measurable control outcome.

Key terms

• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Agentic Access: Agentic access is delegated system access granted to an AI agent or autonomous workflow so it can perform defined tasks across tools and data sources. It differs from human access because the actor can execute continuously, combine actions quickly, and amplify mistakes at scale.
• Sandbox Escape: A sandbox escape is when code breaks out of its intended isolation boundary and gains access to host capabilities. In identity terms, it turns a constrained non-human execution path into a privileged runtime that can touch files, secrets, or downstream systems.
• Ambient Privilege: Ambient privilege is authority that exists in the environment around a workload rather than being intentionally requested for the current task. When an agent can discover and consume that privilege, governance breaks because capability is inherited from exposure, not from explicit need.

What's in the full article

Unosecur's full analysis covers the operational detail this post intentionally leaves for the source:

• The specific SharedRoot chain and how the Linux kernel bug combined with guest configuration choices
• The MCP Gateway control model for binding AI client actions to a real human identity
• The access analyzer, DLP, and tool-monitoring functions described in the article
• The distinction between kernel patching and identity scoping as separate layers of defence

👉 The full Unosecur post covers the SharedRoot chain, the host exposure path, and the identity-layer controls described in context.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.