Claude Cowork’s sandbox is supposed to keep the agent contained.

But we found a chain of vulnerabilities that allowed it to escape.

🧵