Claude Cowork sandbox bypass allows root code execution

Researchers at Armadin identified a bypass in the security boundary of Claude Cowork for Windows, version 1.9255.2.0. A flaw in the signature verification and RPC request handling allows an attacker to escape the Ubuntu virtual machine isolation.

The attack involves replacing the USERENV.dll library in the application directory to execute code as the signed claude.exe process. Sending a JSON request to the cowork-vm-service with the isResume parameter triggers a process with root privileges, while the nsenter utility allows a full escape from the bubblewrap container. The allowedDomains parameter disables network filtering.

Anthropic does not classify this as a security vulnerability. The company maintains that the exploit chain requires the attacker to already possess local code execution rights on the host machine.