🚨 CVE-2026-7574 — Claude Desktop Cowork VM Integrity Bypass

Anthropic Claude Desktop Cowork VM Image Integrity Bypass

🔥 Local Persistence Through VM Image Tampering

An integrity validation weakness allowing modification of the Claude Desktop Cowork VM filesystem image (rootfs.img), enabling persistent code execution inside the VM environment.

---

📖 Overview

CVE-2026-7574 is a high-severity vulnerability affecting Anthropic Claude Desktop Cowork.

The issue arises because the application validates only the existence and version metadata of the virtual machine filesystem image (rootfs.img) before booting the VM. The image contents themselves are not cryptographically verified.

This allows an attacker with local access to replace or modify the VM image and maintain persistent execution capabilities inside the Cowork virtual machine.

🎯 Affected Products

Affected Versions

v1.1348.0 – v1.2278.0

⚡ Vulnerability Details

🧠 Root Cause

The application performs:

✓ File Exists
✓ Version Matches

✗ Integrity Validation
✗ Cryptographic Signature Verification
✗ Secure Hash Validation

As a result, a modified VM filesystem image is trusted during subsequent launches.

🔍 Attack Flow

┌──────────────────────┐
│ Local User Access    │
└──────────┬───────────┘
           │
           ▼
┌──────────────────────┐
│ Modify rootfs.img    │
└──────────┬───────────┘
           │
           ▼
┌──────────────────────┐
│ Claude Starts VM     │
└──────────┬───────────┘
           │
           ▼
┌──────────────────────┐
│ Malicious Image      │
│ Trusted & Executed   │
└──────────┬───────────┘
           │
           ▼
┌──────────────────────┐
│ Persistent Access    │
│ Inside Cowork VM     │
└──────────────────────┘

💥 Potential Impact

Persistence

Attackers can maintain code execution across VM restarts.

Data Exposure

Access to directories mounted between the host and VM.

Post-Compromise Activity

Useful for maintaining footholds after initial compromise.

VM Manipulation

Modified environments may execute attacker-controlled services and scripts.

🛠 Proof-of-Concept Logic

Educational representation only.

# Locate VM image

rootfs.img

# Modify filesystem image

# Replace startup scripts

# Restart Claude Desktop Cowork

# Modified image executes automatically

🛡 Detection

Indicators of Compromise

• Unexpected modification time of rootfs.img
• Unauthorized VM image replacements
• Unknown startup scripts inside the VM
• Persistence surviving application reinstalls
• Unexpected processes within the Cowork VM

🔒 Mitigation

Immediate Actions

• Restrict local access.
• Monitor VM image integrity.
• Implement filesystem auditing.
• Review VM startup configurations.
• Recreate suspicious VM images.

Vendor Recommendation

Implement:

SHA-256 Validation
Cryptographic Signatures
Secure Boot Verification
Image Trust Chains
Runtime Integrity Checks

📅 Timeline

🏷 Classification

CWE-353
Missing Support for Integrity Check

📚 References

• Public CVE Advisory
• Vendor Security Bulletin
• CWE-353 Documentation

⚠ Disclaimer

This repository is intended for:

• Security Research
• Vulnerability Awareness
• Defensive Security Education
• Incident Response Preparation

Do not use this information to attack systems without explicit authorization.