Security researchers at Armadin Inc. have detailed an attack chain that allows arbitrary command execution as root within the sandbox environment of Anthropic PBC’s Claude Cowork, as reported by Silicon Angle. The chain bypasses the isolation layer and removes network restrictions. It exploits two weaknesses in Claude Cowork for Windows: the first allows arbitrary command execution as root by manipulating a resume flag passed through the CoworkVMService, bypassing the creation of a new unprivileged user for each command; the second strips network restrictions by overriding the domain allowlist on a per-command basis with a wildcard, removing egress limitations. Combined, this allows an attacker to exfiltrate sensitive data. Anthropic does not consider this a security issue, stating it requires prior local code execution on the host machine. Armadin validated the chain against Claude Desktop for Windows version 1.9255.2.0.