Claude Cowork Sandbox Flaw Lets Attackers Execute Commands as Root in Hyper

Gbhackers •Divya • July 3, 2026

A newly disclosed sandbox escape technique in Anthropic’s Claude Cowork for Windows illustrates how attackers can achieve root-level command execution inside a Hyper-V–isolated Ubuntu virtual machine (VM) by exploiting design vulnerabilities in CoworkVMService and its Remote Procedure Call (RPC) interface. This issue, documented by researcher Nick McClendon from Armadin, highlights weaknesses in the interaction between […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Vulnerability in Anthropic's Claude Cowork Allows Root Command Execution Security researchers at Armadin Inc. have identified an attack chain in Anthropic PBC’s Claude Cowork that allows attackers to execute arbitrary commands as root within its sandbox environment. This vulnerability exploits two weaknesses in the software for Windows, enabling local code execution to escalate privileges. The first weakness involves manipulating a resume flag to bypass user restrictions, while the second allows attackers to override network restrictions, facilitating data exfiltration. Anthropic does not classify this as a security issue, as it requires prior local code execution on the host machine. The vulnerability affects Claude Desktop for Windows version 1.9255.2.0, raising concerns about endpoint security in AI productivity tools. The attack chain has been validated by Armadin, highlighting the risks associated with non-technical user systems running local virtual machines. 4 sources 52

Extracted Entities

Platforms (2)

Hyper-V Windows