AI and IT News Recap: July 24, 2026: A Claude Cowork Flaw Escapes Its Sandbox to Read Your Mac, Check Point's 9.3 Firewall Bug Is Under Attack, and AI Assistants Find Their Voice

By Noah Smith, Founder, KeyChange Technologies · July 24, 2026

Welcome to your AI and IT news recap for Friday, July 24, 2026. It was a quiet day for splashy product launches but a heavy one for security, led by a striking reminder that the AI agents we invite onto our machines are only as safe as the sandbox around them. Missed yesterday? Catch the July 23 recap.

📌 The AI and IT news at a glance

• 🔝 An AI agent walked out of its own sandbox. A flaw dubbed "SharedRoot" let Claude Cowork escape its Linux VM and read and write files anywhere on the Mac, affecting roughly 500,000 local users.
• 🛡️ A Check Point firewall bug is under active attack. CVE-2026-16232 (CVSS 9.3) hands attackers full admin access to the management console, and CISA wants federal agencies patched by July 25.
• 🛡️ A China-nexus spy crew got exposed by its own mistake. Group-IB uncovered "JadeProx" and a new stealth loader after the group left a cloud server open to the internet.
• 🤖 OpenAI put a voice on your desktop agents. ChatGPT Voice now lets you run your computer and direct Codex and Work agents by talking to them.
• 🤖 Claude's voice mode grew a brain. Anthropic added its Opus and Sonnet models to voice mode, so you can reason through hard problems out loud.

🔝 Today's top story: an AI agent escaped its sandbox and roamed the whole Mac

Security researchers at Accomplish AI disclosed a sandbox escape in Anthropic's Claude Cowork that let the AI agent break out of the Linux virtual machine it runs in and read or write files anywhere on the host Mac. The team, which shared its findings with The Hacker News ahead of publication, codenamed the attack "SharedRoot" and said about 500,000 macOS users running local Cowork sessions were exposed before it was addressed. "We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox," said Oren Yomtov, principal security researcher at Accomplish AI. From inside the VM, the agent reached the host, read and wrote files well outside the single folder that had been shared, and did it all with no permission prompt.

The root cause is architectural rather than a one-off bug. Cowork mounts the entire host filesystem into the agent's VM with read and write access at a path meant to be visible only to guest-root. By chaining a recently disclosed Linux kernel flaw (CVE-2026-46331, known as "pedit COW") the researchers escalated from an ordinary session user to guest-root, at which point the whole Mac was fair game, including SSH keys and cloud credentials. Anthropic reviewed the report and closed it as informative without shipping a dedicated fix, noting that the current version of Cowork defaults to cloud execution, which sidesteps the issue. Anyone who still runs the agent locally remains exposed.

In short: A flaw called SharedRoot let Claude Cowork break out of its virtual machine and access the entire Mac filesystem, affecting around 500,000 local users before cloud execution became the default.

What it means for your business: If your team runs AI coding or automation agents locally, assume the sandbox is not a hard wall and treat anything the agent can reach, such as SSH keys, tokens, and cloud credentials, as potentially exposed. Prefer cloud or tightly scoped execution and limit what folders you connect.

My take: This is the clearest example yet of a trend worth internalizing: the risk with agentic tools is not just what the AI decides to do, it is what an attacker can make it do once code is running on your box. "It runs in a VM" is comforting right up until the VM shares your whole drive. If you are letting agents touch real work, run them in the cloud sandbox or scope their access down to the single folder they actually need.

Source: The Hacker News

🛡️ IT and security

A Check Point firewall bug is under active attack, with a CISA deadline tomorrow

Check Point patched an actively exploited zero-day in SmartConsole, the management client for its security gateways. Tracked as CVE-2026-16232 and rated 9.3, the flaw is an authentication bypass: by abusing improper validation of an application token during login, an unauthenticated attacker can impersonate a legitimate user and gain full administrative control of a Security Management or Multi-Domain Management server. From there, an intruder can rewrite security policy across the estate. Check Point says it found the issue during an internal review and has seen limited real-world exploitation against a small number of customers.

The urgency is real. CISA added CVE-2026-16232 to its Known Exploited Vulnerabilities catalog and set a remediation deadline of July 25 for federal civilian agencies, which is as strong a signal as the government sends that this is being used right now. Affected versions include R81.10, R81.20, R82, and R82.10, plus older unsupported releases, and exposure is worst where the management interface is reachable from the internet without trusted-client restrictions.

In short: Check Point patched CVE-2026-16232, a CVSS 9.3 SmartConsole authentication bypass that is being exploited in the wild to seize full admin control of firewall management servers.

What it means for your business: If you run Check Point, patch now and confirm your management interfaces are not exposed to the open internet. A firewall admin takeover is a worst-case scenario because the attacker can quietly rewrite the rules that protect everything else.

My take: Management planes are the crown jewels, and this is exactly why they should never be internet-facing. The CISA deadline of July 25 tells you how seriously to take it. Patch, then go check your access controls on every admin console you run, not just Check Point.

Source: The Hacker News

A China-nexus spy operation exposed itself by leaving a server wide open

Group-IB published research on a China-nexus espionage operation it tracks as "JadeProx," uncovered after the group left an Alibaba Cloud server exposed to the internet. The exposed contents laid bare active intrusions and targeting across government, healthcare, and education organizations in Asia and Latin America, including a Vietnamese public hospital's medical imaging system, Malaysia's Ministry of Foreign Affairs, education infrastructure in Hong Kong, and a spear-phishing package aimed at the National Congress of Honduras. The star of the toolkit is a previously undocumented Windows loader Group-IB named "TriBack Loader."

TriBack is built to slip past endpoint defenses. It uses a three-file bundle that sideloads a legitimately signed binary to decrypt and run shellcode entirely in memory, leaning on Win32 callback APIs instead of the usual thread-creation routines that security tools watch for. In one campaign the operators disguised their malware as Anthropic's Claude software, dropping a malicious installer into the Windows Startup folder so it would relaunch on every reboot.

In short: Group-IB exposed a China-nexus operation called JadeProx and its stealthy new TriBack Loader after the attackers left a cloud server open, revealing intrusions across government, healthcare, and education targets.

What it means for your business: Attackers increasingly impersonate the AI tools your staff already trust, and they favor signed binaries and in-memory execution to dodge antivirus. Watch what runs from Startup folders and verify that AI software your team installs comes from official sources.

My take: Two lessons here. First, even nation-state crews fumble their own operational security, so basic hygiene like not exposing servers still matters enormously. Second, "it looked like Claude" is going to be a common lure now. Teach people to install AI tools only from the vendor's own site, and treat unexpected AI installers the way you would any other attachment.

Source: The Hacker News

🤖 AI

OpenAI puts a voice on your desktop, and on your coding agents

OpenAI brought ChatGPT Voice to its desktop app, letting you control your computer and direct multiple agents running in ChatGPT Work or Codex using nothing but your voice. It is powered by GPT-Live, OpenAI's full-duplex voice model that can listen and speak at the same time rather than waiting for rigid turns. In practice that means a developer can kick off multi-threaded coding jobs, review pull requests, and debug applications out loud while their hands stay on the keyboard or off it entirely. The feature is rolling out globally on macOS and Windows to Plus, Pro, Business, Edu, and Enterprise plans.

In short: ChatGPT Voice arrived in OpenAI's desktop app, letting users run their computer and orchestrate Codex and Work agents by voice, powered by the full-duplex GPT-Live model.

What it means for your business: Voice is becoming a real control surface for agentic work, not just a novelty for phones. For teams already using Codex or ChatGPT Work, this lowers the friction of delegating and supervising several agents at once.

My take: Hands-free orchestration of multiple coding agents is a genuinely different way of working, and it will feel natural fast. The flip side is supervision: talking to an agent is easy, but you still need to see and approve what it actually did. Great for momentum, not a substitute for review.

Source: VentureBeat

Anthropic gives Claude's voice mode its smarter models

On the same day, Anthropic upgraded Claude's voice mode to run on its Opus and Sonnet models, a notable jump from the Haiku-only setup it launched with. Haiku was chosen for speed, but that capped how well voice mode could handle genuine reasoning. Now you can talk through harder problems, practicing a pitch, weighing competing job offers, or brainstorming a strategy, and switch models mid-conversation from the picker. Free users get Haiku and one connected app, while paid plans unlock Opus, Sonnet, and every connected tool, with support across ten languages.

In short: Anthropic added its Opus and Sonnet models to Claude's voice mode, moving it beyond the speed-focused Haiku so it can reason through complex problems spoken aloud.

What it means for your business: Voice assistants are shifting from quick-answer tools to thinking partners for real work. If your team uses Claude, voice mode is now viable for the kind of longer, messier problem-solving you would previously have typed out.

My take: It is telling that both major labs shipped serious voice upgrades on the same day. Voice as a scratchpad for thinking out loud is underrated, and putting a capable model behind it is what makes that useful rather than gimmicky. Worth a try next time you are stuck on a decision.

Source: TechCrunch

That is your AI and IT news for July 24, 2026. If you run Check Point or any locally hosted AI agent, today's stories are worth acting on before the weekend.