[BUG] [Cowork] Windows: cowork-vm-nat HNS network permanently breaks WSL2 internet connectivity

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Enabling Cowork on Windows creates an HNS (Host Networking Service) network named cowork-vm-nat (type: NAT). This network permanently breaks WSL2's internet connectivity, even after closing Claude Desktop and rebooting the PC. WSL2 can still reach its gateway but all external traffic results in 100% packet loss.

This is a side effect that impacts WSL2 users who are not even actively using Cowork — the mere creation of the cowork-vm-nat HNS network is enough to break WSL2 networking. The network persists in the Windows registry across reboots.

Removing the cowork-vm-nat HNS network immediately restores WSL2 internet connectivity.

Root Cause

WSL2 uses ICS (Internet Connection Sharing) via HNS for its NAT networking. When Cowork creates the cowork-vm-nat HNS network (type: NAT), it interferes with WSL2's ICS-based routing:

• cowork-vm-nat persists even after Claude Desktop is closed or PC is rebooted
• It has no corresponding WinNAT rule (Get-NetNat returns empty) and IP Forwarding is disabled on its virtual adapter
• Yet its mere presence disrupts WSL2's ICS routing — WSL2 can reach its gateway (172.18.64.1) but cannot route beyond it

Environment

• Claude Desktop: Latest (installed Feb 2026)
• OS: Windows 11, Hyper-V enabled
• WSL2: Active with default ICS networking
• VPN/Proxy: None
• No third-party firewall

Relation to Other Issues

This is separate from the widely reported "API unreachable" issues (#24918, #24945, #24962, #25155, #25308). Those focus on Cowork's own VM not reaching the API. This issue is about collateral damage to WSL2 caused by Cowork's HNS network creation.

The original Cowork startup also failed with 0xC03A001A (VHDX compression/encryption error on smol-bin.vhdx), but the WSL2 breakage occurs regardless of whether Cowork itself starts successfully.

What Should Happen?

What Should Happen?

Cowork's HNS network creation should coexist with WSL2's ICS networking without breaking WSL2's internet connectivity. Possible approaches:

1. Test for WSL2 presence before creating the HNS network and use a compatible configuration
2. Clean up the HNS network on Claude Desktop exit (don't leave orphaned networks in the registry)
3. Use a different networking approach that doesn't conflict with ICS (e.g., External vSwitch, or reuse WSL2's existing network infrastructure)

Workaround

Users can restore WSL2 networking by removing the orphaned HNS network:

wsl --shutdown
Get-HnsNetwork | Where-Object { $_.Name -eq "cowork-vm-nat" } | Remove-HnsNetwork
Restart-Service hns
Start-Sleep -Seconds 5
wsl
# Internet should now work

Note: This must be repeated each time Claude Desktop recreates the network.

Error Messages/Logs

# Error Messages/Logs

### HNS Networks (with cowork-vm-nat present — WSL2 broken)


Name                   Type ID
----                   ---- --
cowork-vm-nat          NAT  0CDD34A9-FCD8-4BB4-9E6E-CACCA2BD1869
WSL (Hyper-V firewall) ICS  790E58B4-7939-4434-9358-89AE7DDBE87E
Default Switch         ICS  C08CB7B8-9B3C-408E-8E30-5E16A3AEB444


### Network Adapters


Name                               Status InterfaceDescription
----                               ------ --------------------
vEthernet (cowork-vm-nat)          Up     Hyper-V Virtual Ethernet Adapter
vEthernet (Default Switch)         Up     Hyper-V Virtual Ethernet Adapter #2
vEthernet (WSL (Hyper-V firewall)) Up     Hyper-V Virtual Ethernet Adapter #3


### IP Forwarding (Disabled on all relevant adapters)


InterfaceAlias                     AddressFamily Forwarding
--------------                     ------------- ----------
vEthernet (WSL (Hyper-V firewall))          IPv6   Disabled
vEthernet (cowork-vm-nat)                   IPv6   Disabled
vEthernet (WSL (Hyper-V firewall))          IPv4   Disabled
vEthernet (cowork-vm-nat)                   IPv4   Disabled


### No WinNAT rules configured


PS> Get-NetNat | Format-Table Name, InternalIPInterfaceAddressPrefix
# (empty — no output)


### WSL2 networking while cowork-vm-nat exists


# Gateway reachable — VM-to-host path is fine
$ ping -c 2 172.18.64.1
2 packets transmitted, 2 received, 0% packet loss

# External internet unreachable — NAT/forwarding broken
$ ping -c 3 8.8.8.8
3 packets transmitted, 0 received, 100% packet loss


### WSL2 networking after removing cowork-vm-nat


PS> wsl --shutdown
PS> Get-HnsNetwork | Where-Object { $_.Name -eq "cowork-vm-nat" } | Remove-HnsNetwork
PS> Restart-Service hns
PS> Start-Sleep -Seconds 5



# External internet immediately restored
$ ping -c 2 8.8.8.8
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 14.218/16.008/17.798/1.790 ms

Steps to Reproduce

Steps to Reproduce

1. Have WSL2 working normally with internet access on Windows 11 with Hyper-V enabled
2. Install/open Claude Desktop with Cowork enabled
3. Cowork creates the cowork-vm-nat HNS network (verify with Get-HnsNetwork)
4. Open WSL2 and run ping 8.8.8.8 → 100% packet loss
5. Close Claude Desktop entirely → WSL2 still broken
6. Reboot PC → WSL2 still broken
7. Run Get-HnsNetwork | Where-Object { $_.Name -eq "cowork-vm-nat" } | Remove-HnsNetwork followed by Restart-Service hns → WSL2 immediately works

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

(Claude Desktop) 1.1.3189 (1b7b58)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

_No response_