Claude Cowork Sandbox Escape: RPC Parameter Bypass Enables Root Command Execution — Threadlinqs Intelligence
As of 2026-07-05, Claude Cowork Sandbox Escape: RPC Parameter Bypass Enables Root Command Execution is a medium-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-1115 · Severity: MEDIUM · Status: TRACKING · Category: VULNERABILITY
Security research firm Armadin publicly disclosed a two-stage exploit chain against Anthropic's Claude Cowork on Windows: DLL sideloading of a malicious USERENV.dll to gain code execution inside the
Claude Cowork for Windows (packaged as Claude Desktop for Windows, observed at version 1.9255.2.0, installed under the WindowsApps MSIX path) sandboxes agent-executed code inside a Hyper-V Container System (HCS)-isolated Ubuntu Linux VM. Inside that VM, isolation is layered through bubblewrap namespaces, seccomp filtering, per-session unprivileged Linux users, and a domain-restricted egress (MITM) proxy. The host-to-guest control channel is an Authenticode-gated named-pipe RPC service, CoworkVMService, reachable at \\.\pipe\cowork-vm-service, using a simple [4-byte big-endian length][JSON payload] wire framing.
Armadin researcher Nick McClendon first achieved arbitrary code execution inside the legitimately Anthropic-signed claude.exe process via classic DLL search-order hijacking: claude.exe resolves USERENV.dll from its own application directory before falling back to the genuine System32 copy, so a malicious DLL exporting GetUserProfileDirectoryW and named USERENV.dll, dropped alongside claude.exe (found at C:\Program Files\WindowsApps\Claude_1.9255.2.0_x64__pzs8sxrjxfjjc\app\claude.exe), loads and executes inside the trusted, signed process without ever invalidating the running binary's own Authenticode signature.
From that foothold, the researcher used log analysis, JSON fuzzing, and parameter discovery to reverse-engineer the undocumented CoworkVMService RPC protocol, identifying methods including configure, startVM, isGuestConnected, and spawn. CoworkVMService gates pipe connections using WinVerifyTrust to require the connecting process be signed by "Anthropic, PBC" — but this only authenticates the calling binary's publisher, never authorizing or validating the contents of the RPC request itself. The spawn method exposes two undocumented parameters, isResume and allowedDomains. Normally isResume: false forces creation of a fresh unprivileged per-session Linux user for each command; setting isResume: true instead skips the existing-user validation path entirely, letting the daemon execute the requested command as any specified user — including root — with no authorization check. A crafted request such as {"name": "root", "isResume": true} returns an interactive shell with uid=0, full Linux capabilities, and an unconfined AppArmor profile.
From that root shell, still nominally confined by bubblewrap namespaces, the researcher used nsenter targeting PID 1 (nsenter --target 1 --mount --pid --uts --ipc --net) to join the host VM's mount, PID, UTS, IPC, and network namespaces, fully escaping the bwrap sandbox into the broader Hyper-V-isolated Ubuntu guest. A second, independent flaw in the same spawn method allows the allowedDomains parameter to override the VM's network egress allowlist on a per-command basis; while the default proxy configuration returns HTTP 403 for non-allowlisted domains, submitting "allowedDomains": ["*"] grants the sandboxed session unrestricted outbound network connectivity, defeating the domain-restricted egress proxy that is otherwise Cowork's primary control against data exfiltration and untrusted C2 callbacks from agent-executed code.
Claude Cowork itself launched as a research preview on 2026-01-12 as Anthropic's 'computer agent' for non-technical knowledge workers, followed by a wider enterprise rollout in February 2026 adding third-party connectors (Google Drive, Gmail, DocuSign, FactSet). The Windows sandbox architecture Armadin targeted is the same architecture Anthropic later described publicly in its 2026-05-25 engineering post 'How We Contain Claude Across Products,' which documents the VM-based isolation (Apple's Virtualization framework on macOS, HCS on Windows), the bubblewrap/seccomp guest-level layers, and the api.anthropic.com-scoped egress proxy — precisely the control layers Armadin's chain was built to defeat. Inside CoworkVMService, per-session unprivileged-user enforcement is implemented by a backend component the researcher identified as sdk-daemon, which normally invokes
Weaknesses (CWE)
CWE-427, CWE-863, CWE-284
Target sectors: technology, softwaredevelopment, enterpriseit
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, MEDIUM, threat intelligence, cybersecurity, T1574, T1574, T1574, T1611, T1611, T1562, T1553, T1059, T1106, T1518