[BUG] Cowork Windows 11 Pro: Ghost NAT blocks API connectivity — NetNat rule never created by CoworkVMService

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

CoworkVMService creates the cowork-vm-nat HNS network but fails to register a corresponding Windows NetNat rule. The VM boots and gets network connectivity to the host, but cannot reach the Claude API because there is no NAT translation to the internet.

Get-HNSNetwork shows cowork-vm-nat (Type: NAT) with subnet 172.16.0.0/24, but Get-NetNat returns empty. A ghost NAT is stuck in kernel memory — invisible to all PowerShell cmdlets but blocking any new NAT creation with "duplicate name exists on the network" (Windows System Error 52).

Chat mode works perfectly. Issue is isolated to Cowork VM networking.

What Should Happen?

CoworkVMService should create both the HNS network and a working Windows NetNat rule, or use an alternative routing mechanism that doesn't conflict with ICS/Default Switch. The Cowork workspace should start and connect to the Claude API successfully.

Error Messages/Logs

Failed to start Claude's workspace
Can't reach the Claude API from Claude's workspace.
Restarting Claude or reconnecting to your network sometimes resolves this.

PowerShell diagnostics:
- Get-NetNat returns empty
- Get-CimInstance -Namespace root\StandardCimv2 -ClassName MSFT_NetNat returns empty
- New-NetNat -Name "CoworkNAT" -InternalIPInterfaceAddressPrefix "172.16.0.0/24" fails with:
  "You were not connected because a duplicate name exists on the network" (Windows System Error 52)

Steps to Reproduce

1. Install Claude Desktop latest version on Windows 11 Pro with Hyper-V enabled
2. Sign in with a paid plan
3. Click Cowork tab — workspace fails with "Can't reach the Claude API"
4. Run Get-HNSNetwork — shows cowork-vm-nat exists with NAT type
5. Run Get-NetNat — returns empty (no NetNat rule created)
6. Attempt New-NetNat -Name "CoworkNAT" -InternalIPInterfaceAddressPrefix "172.16.0.0/24" — fails with duplicate name error
7. Removing HNS network, restarting WinNAT, stopping ICS, full reboot — none resolve the ghost NAT

Attempted fixes that did NOT resolve:

• Removed and recreated cowork-vm-nat HNS network
• Stopped ICS (SharedAccess) and removed Default Switch
• Restarted WinNAT service
• Full PC reboot
• Removed VM bundles
• Multiple NAT names including the HNS NatName GUID

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

Claude Desktop latest version

Platform

Other

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

• OS: Windows 11 Pro
• Hyper-V: Fully enabled (Microsoft-Hyper-V-All)
• CoworkVMService: Running
• Default Switch ICS NAT likely conflicting — Windows often only allows one NetNat at a time
• Related issues: #26510, #25308, #24918