Claude Desktop for Windows sandbox flaw could let hackers gain root access

Security research team Armadin found a security flaw in Anthropic's Claude Desktop for Windows. The Claude Cowork feature runs in a Hyper-V isolated Ubuntu virtual machine to reduce risks.

The issue is in the Windows local service CoworkVMService. Researchers used DLL sideloading to make the signed claude.exe load a malicious DLL, bypassing the service's verification. Some execution parameters can modify security settings inside the VM, allowing commands to run as root and override domain whitelists to break network restrictions.

By combining these actions, hackers can gain root access, retrieve process and session data from the same VM, and send it to external servers. Anthropic says the attack requires prior local code execution on the Windows host, so it's not considered a vulnerability. Armadin advises companies to uninstall Claude Desktop if they don't need Claude Cowork, or restrict users and monitor claude.exe for suspicious DLL loading.