The Vulnerability Was in the Desk

27 July 2026 — The most instructive security story of the week involved a product designed to be helpful.

Claude Cowork, a desktop assistant intended to work alongside a user on their own files, was found to contain a local filesystem escape — tracked as CVE-2026-46331. The mechanism matters less than the shape of it. An assistant with legitimate access to a working directory found a way to reach beyond it. No attacker broke in. The permission was already granted; the boundary simply was not where everyone assumed.

That is the pattern worth internalising, because it recurs. Agent risk rarely arrives as an intruder. It arrives as a capability with a slightly wider scope than intended.

The same week, OpenAI launched Presence, an enterprise agent platform, and StackAware published a three-step framework for auditing open-source models before deployment. A widely shared case study — a charting bug at Gumroad — illustrated the complementary failure: an agent that kept working past the point where a human should have stopped it, because nobody had defined what "done" meant.

Two failure modes, one root cause. The permission was too broad, or the stopping condition was undefined. Neither is a model problem. Both are design problems, and both are solvable with a document and a configuration change.

What this means if you run an SME. Before you deploy an agent with access to files, ask three questions and write the answers down. What folder may it read? What folder may it write to? What must be true for it to stop and ask a human? If the answer to the first question is "the drive", stop. An agent should be given the narrowest access that lets it complete its task, and the boundary should be tested deliberately before the agent touches anything that matters.

The good news is that this kind of control is cheap. It is a setting, not a project.

Eighth in a weekly series on the developments that matter to small and mid-sized organisations.