CVE-2026-7574: Anthropic Python VM integrity bypass

CISO Take

Anthropic Claude Desktop's Cowork feature fails to verify the content integrity of its VM root filesystem image (rootfs.img) before booting, trusting any file that carries the right name and version marker string. An unprivileged local attacker who already executes code as the victim macOS user — a bar routinely cleared via malicious dev dependencies, browser exploits, or phishing — can silently replace or patch the VM image and achieve persistent arbitrary code execution on every subsequent Cowork session, including access to host-mounted project directories, credential files, and API keys. With 5,435 downstream dependents, no documented patched version, and a Recon 2026 conference talk reference signaling imminent public research disclosure, the risk window for developer workstations is real. Audit rootfs.img integrity with file integrity monitoring, restrict write access to Claude Desktop application directories, and disable Cowork in sensitive environments until Anthropic issues a fix.

Sources: NVD ATLAS

What is the risk?

High severity (CVSS 8.7, scope:changed). The local attack vector and low-privilege requirement set a bar that is routinely cleared in developer environments through malicious npm or pip packages, compromised browser extensions, or social engineering. The scope:changed scoring reflects that VM compromise translates directly to host-level data access, amplifying impact beyond the immediate process. No public exploit code is available and the CVE is not on CISA KEV, but the Recon 2026 talk reference indicates this will receive public attention within weeks. The fundamental design gap — CWE-353, missing integrity check — means there is no runtime defense-in-depth to compensate; the image is trusted unconditionally.

How does the attack unfold?

Initial Access

Attacker achieves unprivileged local code execution as the victim macOS user via a malicious dev dependency postinstall script or other low-privilege vector.

AML.T0011.001

Tampering

Attacker locates the Claude Desktop Cowork rootfs.img at its predictable application path and patches it with a backdoor, exploiting the absence of any content integrity check.

AML.T0018

Persistence

On the next Cowork VM boot, the modified image passes the version-marker-only validation and launches with attacker code active, persisting across all future sessions.

AML.T0081

Impact

Attacker exfiltrates host-mounted directories containing source code, API keys, cloud credentials, and AI artifacts, with access surviving application restarts indefinitely.

AML.T0037

Initial Access

Attacker achieves unprivileged local code execution as the victim macOS user via a malicious dev dependency postinstall script or other low-privilege vector.

AML.T0011.001

Tampering

Attacker locates the Claude Desktop Cowork rootfs.img at its predictable application path and patches it with a backdoor, exploiting the absence of any content integrity check.

AML.T0018

Persistence

On the next Cowork VM boot, the modified image passes the version-marker-only validation and launches with attacker code active, persisting across all future sessions.

AML.T0081

Impact

Attacker exfiltrates host-mounted directories containing source code, API keys, cloud credentials, and AI artifacts, with access surviving application restarts indefinitely.

AML.T0037

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Anthropic Python	pip	—	No patch
3.8K 6.2K dependents Pushed 10d ago 89% patched ~10d to patch Full package profile →
Claude Code	npm	—	No patch
139.9K Pushed 14d ago 69% patched ~5d to patch Full package profile →

How severe is it?

CVSS 3.1

8.7 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 4% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Changed

C High

I High

A Low

What should I do?

6 steps

Identify all developer workstations with Claude Desktop Cowork enabled across the organization.
Deploy file integrity monitoring (e.g., OSSEC, Wazuh, or macOS built-in) targeting the Claude Desktop Cowork application directory and rootfs.img specifically — alert on unexpected modifications.
Restrict filesystem write permissions on Claude Desktop application directories to the minimum necessary; evaluate whether unprivileged users require write access at all.
Monitor Anthropic's security advisories for a patched version; confirmed affected range is v1.1348.0 through v1.2278.0 with no documented fix.
Disable the Cowork feature in high-sensitivity environments (production access, regulated data) until a patch is available.
Review macOS user accounts running Claude Desktop for concurrent exposure to untrusted code execution (unaudited dev dependencies, browser extensions).

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Data Extraction Agent API AML.T0010.001 - AI Software AML.T0037 - Data from Local System AML.T0081 - Modify AI Agent Configuration AML.T0105 - Escape to Host AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - Controls to address AI risks

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place to sustain the value of deployed AI systems

OWASP LLM Top 10

LLM05 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-7574?

Anthropic Claude Desktop's Cowork feature fails to verify the content integrity of its VM root filesystem image (rootfs.img) before booting, trusting any file that carries the right name and version marker string. An unprivileged local attacker who already executes code as the victim macOS user — a bar routinely cleared via malicious dev dependencies, browser exploits, or phishing — can silently replace or patch the VM image and achieve persistent arbitrary code execution on every subsequent Cowork session, including access to host-mounted project directories, credential files, and API keys. With 5,435 downstream dependents, no documented patched version, and a Recon 2026 conference talk reference signaling imminent public research disclosure, the risk window for developer workstations is real. Audit rootfs.img integrity with file integrity monitoring, restrict write access to Claude Desktop application directories, and disable Cowork in sensitive environments until Anthropic issues a fix.

Is CVE-2026-7574 actively exploited?

No confirmed active exploitation of CVE-2026-7574 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-7574?

1. Identify all developer workstations with Claude Desktop Cowork enabled across the organization. 2. Deploy file integrity monitoring (e.g., OSSEC, Wazuh, or macOS built-in) targeting the Claude Desktop Cowork application directory and rootfs.img specifically — alert on unexpected modifications. 3. Restrict filesystem write permissions on Claude Desktop application directories to the minimum necessary; evaluate whether unprivileged users require write access at all. 4. Monitor Anthropic's security advisories for a patched version; confirmed affected range is v1.1348.0 through v1.2278.0 with no documented fix. 5. Disable the Cowork feature in high-sensitivity environments (production access, regulated data) until a patch is available. 6. Review macOS user accounts running Claude Desktop for concurrent exposure to untrusted code execution (unaudited dev dependencies, browser extensions).

What systems are affected by CVE-2026-7574?

This vulnerability affects the following AI/ML architecture patterns: Local AI agent environments, AI developer workstations with agentic coding tools, Agentic coding and CI/CD pipelines, AI desktop application deployments.

What is the CVSS score for CVE-2026-7574?

CVE-2026-7574 has a CVSS v3.1 base score of 8.7 (HIGH). The EPSS exploitation probability is 0.14%.

What is the AI security impact?

Affected AI Architectures

Local AI agent environmentsAI developer workstations with agentic coding toolsAgentic coding and CI/CD pipelinesAI desktop application deployments

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0037 Data from Local System

AML.T0081 Modify AI Agent Configuration

AML.T0105 Escape to Host

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through v1.2278.0, including v1.1348.0, v1.1617.0, and v1.2278.0) validates only file presence and a version marker string before booting rootfs.img, but does not verify image content integrity at time-of-use. A local attacker with unprivileged code execution as the victim macOS user can modify the VM root filesystem image and have it trusted on subsequent Cowork VM boots, enabling persistent arbitrary code execution in the VM and access to host-mounted directories. The estimated CWE mapping is CWE-353 (Missing Support for Integrity Check).

Exploitation Scenario

An attacker delivers a malicious npm package as a transitive dependency in a developer's AI project. At install time, the package executes a postinstall script that locates the Claude Desktop Cowork VM image at its predictable macOS application path. The attacker patches rootfs.img to embed a reverse shell and a credential harvester targeting ~/.aws, ~/.anthropic, and any directory mounted into the VM. Because Claude Desktop validates only file presence and a version marker string — never content integrity — the modified image passes all checks on the developer's next Cowork session. The reverse shell activates, the harvester exfiltrates API keys and source code, and the implant persists across all future Cowork boots with no user-visible indication of compromise.

Weaknesses (CWE)

CWE-353 Missing Support for Integrity Check CWE-353 Missing Support for Integrity Check

CWE-353 — Missing Support for Integrity Check: The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

[Architecture and Design] Add an appropriately sized checksum to the protocol, ensuring that data received may be simply validated before it is parsed and used.
[Implementation] Ensure that the checksums present in the protocol design are properly implemented and added to each message before it is sent.

Source: MITRE CWE corpus.