Claude Desktop Cowork CVE-2026-7574

Requires the attacker to already be running unprivileged code as the victim macOS user account that owns the Claude Desktop Cowork installation, with filesystem write access to the rootfs.img backing the Cowork VM. The victim must run a vulnerable build (v1.1348.0 through v1.2278.0) and must subsequently boot or reboot the Cowork VM for the swapped image to be loaded - exploitation is gated on that next-boot event rather than immediate. No user interaction with a malicious payload is needed beyond normal Cowork usage (UI:N), and no elevation to root or admin on macOS is required because the attack operates entirely within the user's own profile. The attack does not work against hosts that do not run Cowork or against users who never launch the VM after tampering.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L produces an 8.7 score driven mainly by the scope change (S:C) - exploitation inside the user's context lets the attacker pivot into the Cowork VM trust boundary and reach host-mounted directories, which is genuinely a cross-boundary impact rather than just same-user code execution. Real-world urgency is tempered: AV:L means an attacker must already have unprivileged code execution as the victim macOS user, so this is a persistence and privilege/boundary-crossing primitive rather than an initial-access bug. No EPSS score, KEV listing, or public POC was supplied; the only references are a Recon 2026 talk abstract and a GCVE entry, suggesting research-disclosure provenance rather than observed in-the-wild use. The signals are internally consistent (local vector matches the described threat model), but absence of vendor advisory and patch metadata in the input means defenders should verify fix availability directly with Anthropic before deprioritizing.

An attacker who has already obtained unprivileged code execution as the victim macOS user - for example via a malicious npm dependency, a phishing-delivered binary, or a compromised local dev tool - locates the Cowork rootfs.img in the user's profile, writes a modified image that preserves the expected version marker string but contains attacker-controlled init scripts, and waits. On the next Cowork VM boot the launcher's presence-and-marker check passes and the tampered image is mounted as root, giving the attacker persistent code execution inside the VM and read/write access to whichever host directories the user has mounted in. No public POC is referenced in the available data.