Claude Cowork Sandbox Flaw Lets Attackers Execute Commands as Root in Hyper-V VM

A newly disclosed sandbox escape technique in Anthropic’s Claude Cowork for Windows illustrates how attackers can achieve root-level command execution inside a Hyper-V–isolated Ubuntu virtual machine (VM) by exploiting design vulnerabilities in CoworkVMService and its Remote Procedure Call (RPC) interface.

This issue, documented by researcher Nick McClendon from Armadin, highlights weaknesses in the interaction between Authenticode-gated named-pipe RPC, bubblewrap namespaces, seccomp filters, per-session unprivileged users, and a domain-restricted egress proxy.

These vulnerabilities ultimately enable privilege escalation and unrestricted network access within the virtualized environment.

Claude Cowork, part of Claude Desktop for Windows, uses the Host Compute Service to manage an Ubuntu VM, similar to Windows Subsystem for Linux v2.

This setup remains invisible from Hyper-V while exposing functionality through CoworkVMService, a Local System service. This service communicates via a named pipe (.\pipe\cowork-vm-service) using a JSON-based RPC server.

While CoworkVMService enforces Authenticode signature validation via WinVerifyTrust, ensuring that only binaries signed by “Anthropic, PBC” can connect, this mechanism does not validate identity.

However, it does not enforce authorization over the contents of RPC requests. Logs saved in C:\ProgramData\Claude\Logs\cowork-service.log provide enough telemetry for attackers to reverse-engineer the protocol. This includes method structures such as configure, startVM, isGuestConnected, and spawn.

After unsuccessfully trying to bypass signature validation directly, Armadin utilized DLL sideloading (MITRE ATT&CK T1574/002) by targeting USERENV.dll, specifically the GetUserProfileDirectoryW export.

Because claude.exe resolves USERENV.dll from its application directory before the system path, placing a malicious DLL alongside the executable enabled arbitrary code execution within a trusted, signed process. This sideloaded context inherited Authenticode trust, allowing successful interaction with the named pipe service.

Using a custom RPC client developed through log analysis, fuzzing, and parameter discovery, the researcher identified critical weaknesses in the spawn method. The JSON payload format ([4-byte big-endian length][JSON payload]) exposed undocumented parameters, including isResume and allowedDomains.

When isResume was set to false, sdk-daemon enforced sandbox restrictions by creating a new unprivileged Linux user via useradd. However, setting isResume to true bypassed this control entirely, allowing execution as any existing user, including root, without validation.

A crafted request with “name”: “root” and “isResume”: true returned a shell with uid=0, full Linux capabilities (CapEff: 000001ffffffffff), and an unconfined AppArmor profile.

Importantly, the sandbox isolation enforced by bubblewrap could be bypassed using nsenter targeting PID 1, allowing escape into the host VM namespaces (mount, PID, UTS, IPC, and network). This provided full visibility into processes, access to sensitive files such as/etc/shadow, and the ability to modify the sdk-daemon and seccomp BPF filters.

Additionally, the allowedDomains parameter allowed bypassing the proxy’s network restrictions. While the default configuration returned HTTP 403 for blocked domains, setting “allowedDomains”: [“*”] enabled unrestricted outbound connectivity, as confirmed by successful HTTP 200 responses and exfiltration to attacker-controlled infrastructure.

By combining both of these techniques in a single spawn request, attackers can execute commands as root, escape the sandbox using nsenter, and exfiltrate sensitive data, such as /etc/shadow, using curl with base64 encoding, all from within the VM while remaining undetected by host-based defenses.

Despite the responsible disclosure on March 20, 2026, Anthropic classified the issue as not a security vulnerability, arguing that local code execution on the host system is a prerequisite.

This research underscores a broader shift in attack surfaces introduced by AI productivity tools like Claude Cowork. The delegation of trust enforcement to client-controlled RPC parameters, combined with visibility gaps introduced by virtualization, creates exploitable conditions in which fast-acting attackers can weaponize misconfigurations faster than defenders can detect them.

Defensive recommendations include restricting the use of Claude Desktop via AppLocker Packaged App rules and monitoring Sysmon Event ID 7 for anomalous DLL loads, such as USERENV.dll, outside C:\Windows\System32, to indicate potential sideloading attempts.

Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN