Claude Sandbox Flaw Allegedly Enables Root Access to Virtual Machine
Anthropic’s Claude Cowork is a knowledge-work automation tool whose Windows version runs Claude Code inside a Hyper-V-isolated Ubuntu virtual machine, with restricted permissions and external network access. The sandbox serves as a security boundary between the host and the AI software. If bypassed, an attacker could potentially read session data within the same virtual machine and even modify protective components.
On July 1, 2026, Armadin disclosed an attack chain it had verified in version 1.9255.2.0. The chain uses DLL sideloading to make claude.exe pass checks by a local service, then exploits parameters to obtain root access and remove restrictions on external connections. The team reported the issue on March 20. On March 24, Anthropic declined to classify it as a security issue, saying an attacker would first need the ability to run a program on Windows.
All Coverage
1 original reportsThe Backstory
The history behind this eventAnthropic Patches Claude Desktop PromptFiction Flaw
Anthropic’s Claude desktop app gives users direct access to its generative artificial intelligence tools, but links and local-computer permissions can widen the software’s attack surface. Security researchers identified a vulnerability dubbed PromptFiction that showed how prompt-injection techniques could move beyond a webpage and affect a desktop application, raising risks to private conversations and, in more privileged configurations, files and code stored on a user’s device.
The researchers said an attacker could craft a malicious link that, once clicked, caused Claude’s desktop app to submit concealed instructions automatically and potentially expose conversation data. The impact could become more severe if the application had permission to access local files, creating a path for malicious code to be planted on the computer. Anthropic addressed the flaw in Claude desktop version 1.1.2321, and users are advised to update to the patched release.
Subscribe to Mark Radar Weekly
Every Friday, the week's strongest signals in your inbox. Unsubscribe anytime.
If you search news on Google, you can set Mark Radar as a preferred source—our coverage will show up more often in your results. Set as preferred source on Google →