[BUG] Cowork Windows - ICS-type HNS network creates ghost NAT that doesn't route and blocks WinNAT

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Cowork consistently fails with "Failed to start Claude's workspace — Can't reach the Claude API from Claude's workspace" and "API Error: Unable to connect to API (ECONNRESET)".

The VM boots, gets local network connectivity (CONNECTED), but cannot route outbound traffic to api.anthropic.com. Regular Chat mode works perfectly — only Cowork is affected.

What Should Happen?

Cowork should create a NAT-type HNS network (not ICS) that properly routes VM traffic to the internet, allowing the VM to reach api.anthropic.com.

Error Messages/Logs

Failed to start Claude's workspace
Can't reach the Claude API from Claude's workspace.
Restarting Claude or reconnecting to your network sometimes resolves this.

Steps to Reproduce

1. Install Claude Desktop 1.1.4173.0 on Windows 11 Pro with Hyper-V enabled
2. Open app → Click Cowork tab
3. VM downloads, boots, gets CONNECTED status
4. API reachability goes PROBABLY_UNREACHABLE → UNREACHABLE
5. Error displayed: "Failed to start Claude's workspace — Can't reach the Claude API"

Claude Model

Not sure / Multiple models

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

1.1.4173.0

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Other

Additional Information

VM Log Pattern (repeatable every attempt)

[VM] Network status: NOT_CONNECTED
[VM:network] Not connected, will show error in 30000ms if not resolved
[VM] Network status: CONNECTED
[VM:steps] sdk_install started
[VM:start] Installing SDK: subpath=AppData/Roaming/Claude/claude-code-vm, version=2.1.51
[VM:steps] sdk_install completed (2186ms)
[VM:start] Startup complete, total time: 13214ms
[Keepalive] Starting (interval=2000ms)
[VM] API reachability: PROBABLY_UNREACHABLE
[VM] API reachability: UNREACHABLE
[VM:network] API is unreachable

HNS Network (ICS type — this is the problem)

PS> Get-HnsNetwork | Format-List Name, Type, Subnets

Name     : cowork-vm-vnet
Type     : ICS
Subnets  : {@{AddressPrefix=172.16.0.0/24; GatewayAddress=172.16.0.1; ...}}

Ghost NAT — invisible but blocks WinNAT

# No WinNAT rules visible
PS> Get-NetNat
# (empty)

# No WMI NAT entries
PS> Get-CimInstance -Namespace root/StandardCimv2 -ClassName MSFT_NetNat
# (empty)

# But WinNAT creation is blocked by invisible ICS NAT
PS> New-NetNat -Name "cowork-vm-nat" -InternalIPInterfaceAddressPrefix "172.16.0.0/24"
New-NetNat : You were not connected because a duplicate name exists on the network.
# Windows System Error 52

# Even a different name fails
PS> New-NetNat -Name "cowork-nat-manual" -InternalIPInterfaceAddressPrefix "172.16.0.0/24"
New-NetNat : You were not connected because a duplicate name exists on the network.
# Windows System Error 52

No network adapter created for the VM

PS> Get-NetAdapter | Where-Object { $_.Name -like "*cowork*" }
# (empty)

PS> Get-NetIPInterface -InterfaceAlias "vEthernet (cowork-vm-nat)"
# No MSFT_NetIPInterface objects found

Host reaches API fine

PS> Test-NetConnection -ComputerName api.anthropic.com -Port 443
ComputerName     : api.anthropic.com
RemoteAddress    : 160.79.104.10
RemotePort       : 443
InterfaceAlias   : Wi-Fi
SourceAddress    : 192.168.12.105
TcpTestSucceeded : True

Catch-22 proven

# Step 1: Remove ICS network
PS> Get-HnsNetwork | Where-Object { $_.Name -eq "cowork-vm-vnet" } | Remove-HnsNetwork

# Step 2: WinNAT now creates successfully
PS> New-NetNat -Name "cowork-vm-nat" -InternalIPInterfaceAddressPrefix "172.16.0.0/24"
Name: cowork-vm-nat | Active: True  # ✅ Works!

# Step 3: But VM can't boot without the HNS network
# VM boot failed: HcnCreateEndpoint failed: hr=0x80070490, "Element not found"

# Step 4: Restart Claude → it recreates ICS network → nukes the working NAT → back to square one

Troubleshooting Already Attempted

• ✅ Enabled full Hyper-V (was initially disabled)
• ✅ Rebooted multiple times
• ✅ Deleted VM bundle (%APPDATA%\Claude\vm_bundles) and let it re-download
• ✅ Removed and recreated HNS networks
• ✅ Started SharedAccess (ICS) service and set to Automatic
• ✅ Restarted HNS and vmcompute services
• ✅ Manually created WinNAT rule (works only when ICS network removed, but then VM can't boot)
• ✅ Disabled/checked firewalls
• ✅ Verified host connectivity to api.anthropic.com
• ✅ Clean reinstall of VM bundle

Expected Behavior

Cowork should create a NAT-type HNS network (not ICS) that properly routes VM traffic to the internet, allowing the VM to reach api.anthropic.com.

Related Issues

• #25155 - Cowork Windows - VM boots but cannot reach Claude API
• #25205 - Cowork API connection issue + Cowork Tab disappears on restart
• #24918 - Cowork Windows - Cannot connect to Claude API from workspace
• #25308 - Cowork VM starts but API is UNREACHABLE on Windows 11
• #25144 - Cowork VM uses DNS from disconnected adapter
• #26510 - NAT rule creation fails with "duplicate name" error

cowork_vm_node.log
event-log.txt
log-file-listing.txt
network-diagnostics.txt
services.txt
system-info.txt
vm-bundle-contents.txt