Windows: cowork-svc.exe burns 17-20% CPU due to per-request Authenticode verification on 1-second polling loop

Description

On Windows, cowork-svc.exe (CoworkVMService) continuously consumes 17-20% CPU and ~0.1 MB/s network bandwidth while completely idle. The service log at C:\ProgramData\Claude\Logs\cowork-service.log grew to 807K+ lines (512KB) in 4 days.

Root Cause

The Claude Desktop app polls the cowork service via named pipe (\.\pipe\cowork-vm-service) every ~1 second with two alternating RPC calls: isGuestConnected and isProcessRunning. Each request:

1. Opens a new named pipe connection
2. Triggers a full Authenticode signature verification of claude.exe
3. Forwards the request to the VM over HyperV sockets
4. Disconnects immediately ("no active connections, idle timeout starts")

The signature verification takes ~960ms per call, meaning the service spends nearly 100% of its processing time on repeated crypto verification of the same binary.

Evidence from logs

15:17:13.968  Client connected, method=isGuestConnected
15:17:14.935  Client signature verified  (967ms delta)
15:17:14.935  Sent response
15:17:14.936  Client connected, method=isProcessRunning
15:17:15.901  Client signature verified  (965ms delta)
15:17:15.902  RPC to VM + Sent response
15:17:15.970  Client connected, method=isGuestConnected
...repeats indefinitely

127,787 polling requests logged since March 3 (4 days).

Environment

• Windows 11 (10.0.22631)
• Claude Desktop v1.1.5368.0 (Windows Store / MSIX)
• cowork-svc.exe at C:\Program Files\WindowsApps\Claude_1.1.5368.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe

Suggested Fixes

• Cache the signature verification result — verify once, then check file hash/mtime on subsequent calls
• Reduce polling frequency when idle — 10-30s instead of 1s
• Reuse the named pipe connection instead of connect/disconnect per poll

Related

Related to #22543 (macOS cowork VM performance degradation). Both issues stem from the cowork VM service being resource-heavy while idle, though the specific mechanism differs (this is Windows Authenticode overhead vs macOS VM bundle bloat).

---
Filed via Claude Code