[BUG] Cowork Windows: CSP blocks a-api.anthropic.com + VM API Unreachable (Windows 10 Pro, MSIX)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Cowork on Windows 10 Pro (MSIX build) consistently fails with:

Failed to start Claude workspace — Unable to connect to Claude API from Claude's workspace.

Regular Chat mode works; only Cowork is affected.

Root cause appears to be a CSP mismatch in the Windows build:

• connect-src allows a-cdn.anthropic.com
• but blocks https://a-api.anthropic.com/v1/m

This mirrors #18006 (macOS CSP bug, fixed) but appears unported to Windows MSIX.

What Should Happen?

Cowork workspace VM should be able to reach Anthropic API endpoints and start successfully on Windows MSIX builds without CSP blocking API requests.

Error Messages/Logs

2026-02-20 21:41:56 [error] Connecting to 'https://a-api.anthropic.com/v1/m' violates the
following Content Security Policy directive: "connect-src 'self' https://api.segment.io
https://*.segment.io https://*.segment.com https://a-cdn.anthropic.com https://*.google.com
https://*.facebook.com https://*.facebook.net https://*.doubleclick.net". The action has been blocked.

2026-02-20 21:41:56 [error] Fetch API cannot load https://a-api.anthropic.com/v1/m.
Refused to connect because it violates the document's Content Security Policy.

2026-02-20 21:41:56 [error] Error sending segment performance metrics TypeError: Failed to fetch

2026-02-20 21:41:45 [info] [Spawn:vm] ... OAuth token approved with MITM proxy
2026-02-20 21:41:45 [info] [Spawn:vm] ... Spawn succeeded in 684ms
2026-02-20 21:42:03 [info] [VM] API reachability: UNREACHABLE

Steps to Reproduce

1. On Windows 10 Pro 64-bit, run Claude Desktop MSIX 1.1.3541.0 (Claude_pzs8sxrjxfjjc)
2. Ensure CoworkVMService is running and VirtualMachinePlatform is enabled
3. Open Claude Desktop and switch to Cowork
4. Start workspace in a local folder
5. Observe startup failure with API reachability error
6. Check claude.ai-web.log and see CSP block for https://a-api.anthropic.com/v1/m

Claude Model

Not sure / Multiple models

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Claude Desktop 1.1.3541.0 (MSIX), Claude Code VM SDK 2.1.45

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

Environment summary:

• OS: Windows 10 Pro 64-bit
• Hyper-V features: disabled
• VirtualMachinePlatform: enabled
• VPN/Proxy: none (netsh winhttp show proxy = direct)
• WSL2 installed (172.30.80.0/20), no overlap with Cowork NAT (172.16.0.0/24)
• Docker not running

Network diagnostics:

• Host can reach API: Test-NetConnection api.anthropic.com -Port 443 succeeds
• HNS network exists (cowork-vm-nat, 172.16.0.0/24)
• Get-NetNat returns empty
• Manual New-NetNat fails with Error 52 (duplicate name)
• vEthernet (cowork-vm-nat) forwarding was initially disabled; enabling it did not fix issue

Likely action items:

1. Include a-api.anthropic.com (or *.anthropic.com) in Windows MSIX CSP connect-src
2. Ensure WinNAT rule creation is consistent with HNS network provisioning on Windows
3. Revisit VM API reachability check path since VM spawn succeeds but reachability still reports unreachable

Related issues:

• #18006 (macOS CSP bug fixed)
• #25024
• #24918
• #25155
• #25308
• #26510