CVE-2026-7574: Claude Desktop Cowork VM Image Integrity Verification Flaw

Technical summary

CVE-2026-7574 is a missing integrity verification vulnerability in Claude Desktop's Cowork VM image handling across versions v1.1348.0 through v1.2278.0. The application validates only file presence and a version marker string before booting rootfs.img, without implementing cryptographic or checksum-based integrity verification. This absence of integrity checks (CWE-353) permits a local, unprivileged process running under the user's context to modify the VM image file. On subsequent boot, the modified image is trusted and executed, granting arbitrary code execution within the VM's root context and access to mounted host directories. The attack requires pre-existing local code execution as the victim's user but does not require privilege escalation.

Business impact

Organizations using Claude Desktop for sensitive development or data analysis workflows face heightened risk of data exfiltration and persistent compromise. A single malicious script or supply-chain compromised dependency that achieves user-level code execution can corrupt the VM environment and maintain stealth access across application restarts. Cowork VM environments that mount project directories, credentials, or proprietary code create a bridging attack surface between the host filesystem and the isolated VM, amplifying the exposure to intellectual property theft and credential harvesting.

Affected systems

Claude Desktop versions v1.1348.0 through v1.2278.0 are confirmed affected, including intermediate releases v1.1617.0 and v1.2278.0. The vulnerability is triggered when Cowork VM functionality is in use. Any macOS user running these versions is exposed if their system executes untrusted code at user privilege level.

Exploitability

Exploitation requires that an attacker first achieve unprivileged code execution as the victim macOS user—a realistic precondition given the proliferation of user-level code execution vulnerabilities in browsers, document processors, and development tools. Once code execution is obtained, the attack is trivial: modifying the rootfs.img file in the expected location requires no special techniques or race conditions. The absence of integrity verification means the tampered image will be trusted on the next VM boot. No user interaction beyond normal application usage is required. The attack surface is local and does not require network access or administrator privileges.

Remediation

Apply a Claude Desktop update that implements cryptographic integrity verification (HMAC or signature-based validation) for VM images prior to loading. Verify the specific patch version against Anthropic's official security advisory. Until patched, reduce exposure by minimizing use of Cowork VM features and avoiding execution of untrusted code (including third-party scripts, pip packages, or npm modules) within the macOS user session. Consider runtime isolation at the OS level, such as restricting script execution via System Integrity Protection or endpoint detection and response tooling.

Patch guidance

Patch information and affected version ranges should be confirmed against the official Anthropic security advisory. Organizations should prioritize updating Claude Desktop to a version that includes integrity verification for VM images. Testing should confirm that Cowork VM functionality remains operational post-patch and that any previously modified images are either rejected or re-initialized safely.

Detection guidance

Monitor for unexpected modifications to rootfs.img files in Claude Desktop's VM storage directories (commonly under ~/Library/Application Support/Claude or similar macOS application support paths). File integrity monitoring tools can detect unauthorized writes to these locations. Detect suspicious processes spawning as children of Claude Desktop with capabilities to modify files outside the VM. Check for unusual activity emerging from Cowork VM processes that access host-mounted directories or exfiltrate data. Log and alert on any unexpected resets or re-initialization of VM images.

Why prioritize this

The CVSS 3.1 score of 8.7 (HIGH) reflects the broad impact scope—code execution in the VM with access to mounted host directories—combined with the ease of exploitation once user-level code execution is achieved. Although an attacker must first compromise user privileges (not system-wide), this is a common and realistic threat model. Organizations deploying Claude Desktop in software development or secure data analysis workflows should prioritize remediation to prevent persistent VM compromise and lateral movement to host systems.

Risk score, explained

The score of 8.7 accounts for: (1) local attack vector (AV:L), reducing severity compared to network exploits; (2) low attack complexity (AC:L), as no bypasses or complex steps are required once code execution is obtained; (3) low privilege requirement (PR:L), since user-level execution is sufficient; (4) no user interaction needed (UI:N); (5) changed scope (S:C), because the impact crosses the VM boundary to affect mounted host directories; and (6) high confidentiality and integrity impact (C:H, I:H) from persistent code execution and filesystem access, with low availability impact (A:L) from the nature of the attack. The score reflects a serious local privilege escalation path rather than a critical network-facing vulnerability.

Frequently asked questions