Executive brief
Anthropic Claude Desktop Cowork contains a security flaw in how it handles its virtual machine (VM) images on macOS. An attacker who has already gained basic access to a user's computer could modify the VM's system files to gain persistent control over the Claude environment. This could allow the attacker to steal sensitive data from folders shared between the computer and the Claude application.
Technical details
The vulnerability is a missing integrity check (CWE-353) in the Cowork VM image handling logic. The application validates only the presence of the 'rootfs.img' file and a version marker string before booting, failing to perform cryptographic signature or hash verification at time-of-use. A local attacker with unprivileged access as the victim macOS user can modify the root filesystem image. Upon the next boot, the modified image is trusted, granting the attacker persistent arbitrary code execution within the VM and access to any host directories mounted into the VM environment.
Affected products
- Anthropic Claude Desktop Cowork 1.1348.0 through 1.2278.0
Timeline
- 2026-06-24: disclosed: Published in NVD dataset