[BUG] Cowork: CoworkVMService crashes with "signature verification initialization failed" — works in interactive mode

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Environment

| Property | Value |
|----------|-------|
| OS | Windows 11 Pro, Version 25H2 (OS Build 26200.8037) |
| Claude Desktop version | 1.1.8359.0 |
| Subscription | Pro |
| Hyper-V | Enabled and confirmed working (vmms Running/Automatic, vmcompute Running/Manual) |
| Antivirus | Norton 360 (tested with protections disabled — same result) |

What's Wrong?

Cowork fails to start with: "Failed to start Claude's workspace — VM service not running. The service failed to start."

The CoworkVMService installs, immediately has its start type changed from auto start to disabled, and then terminates with "Incorrect function" (error code 0x1).

Root cause identified: The cowork-service.log shows the service crashes during signature verification because it cannot resolve its own executable path within the WindowsApps folder:

Service error: signature verification initialization failed: failed to get service executable path: The system cannot find the path specified.

However, running cowork-svc.exe directly in interactive mode works perfectly. In interactive mode, the same path resolution failure is treated as a non-fatal warning:

[Server] WARNING: Could not get service executable path: The system cannot find the path specified.
[Server] WARNING: Client signature verification is DISABLED
[Server] Starting named pipe server on \\.\pipe\cowork-vm-service

The VM then boots successfully, network connects, API is reachable, and Cowork functions normally.

What Should Happen?

Expected Behaviour

CoworkVMService should start successfully. The signature verification path resolution should either work correctly in service mode, or gracefully fall back to disabled verification (as it already does in interactive mode) rather than treating the error as fatal.

Error Messages/Logs

## Evidence

### Event Log — Service repeatedly crashes


TimeCreated : 24/03/2026 17:11:48
Message     : The Claude service terminated with the following service-specific error: Incorrect function.

TimeCreated : 24/03/2026 17:08:48
Message     : A service was installed in the system.
              Service Name: Claude
              Service File Name: "C:\Program Files\WindowsApps\Claude_1.1.8359.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe"
              Service Type: user mode service
              Service Start Type: auto start
              Service Account: LocalSystem

TimeCreated : 24/03/2026 17:08:48
Message     : The start type of the Claude service was changed from auto start to disabled.


### cowork-service.log — Fatal error in service mode


2026/02/28 14:04:06.689388 Claude VM Service starting...
2026/02/28 14:04:06.698826 [HCS] vmcompute.dll loaded successfully
2026/02/28 14:04:06.701929 [HCS] computecore.dll loaded successfully
2026/02/28 14:04:06.702478 [HCS] Procs initialized, HCS ready
2026/02/28 14:04:06.714458 [HCN] EnumerateNetworks result: ["c08cb7b8-9b3c-408e-8e30-5e16a3aeb444"]
2026/02/28 14:04:06.731419 Service error: signature verification initialization failed: failed to get service executable path: The system cannot find the path specified.


### Interactive mode — Same error handled gracefully, everything works


2026/03/24 17:47:35.672502 [Server] WARNING: Could not get service executable path: The system cannot find the path specified.
2026/03/24 17:47:35.672502 [Server] WARNING: Client signature verification is DISABLED
2026/03/24 17:47:35.672502 [Server] Starting named pipe server on \\.\pipe\cowork-vm-service
2026/03/24 17:47:35.674114 Service ready. Listening on \\.\pipe\cowork-vm-service
...
2026/03/24 17:50:30.583192 [RPC] Network status: CONNECTED
2026/03/24 17:50:32.352092 [RPC] API reachability: REACHABLE
2026/03/24 17:50:21.652013 [VM] VM started successfully


### Service registration path confirmed correct


PS> Get-WmiObject Win32_Service -Filter "Name='CoworkVMService'" | Select PathName
# "C:\Program Files\WindowsApps\Claude_1.1.8359.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe"

PS> Test-Path "C:\Program Files\WindowsApps\Claude_1.1.8359.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe"
# True


### VM bundle files present and correctly sized

All expected files present in `%APPDATA%\Claude\vm_bundles\claudevm.bundle\`:
- rootfs.vhdx (9.25 GB)
- initrd (175 MB)
- vmlinuz (14.9 MB)
- smol-bin.vhdx (37.7 MB)

### Additional confirmed

- `staterepository` service (dependency): Running/Automatic
- No Group Policy restrictions on services
- No security software blocking (Norton disabled during testing)
- `Get-NetNat` returns empty (service crashes before network setup)
- Reinstalling Claude Desktop temporarily fixes the issue until the next auto-update re-triggers it

## Suggested Fix

In `cowork-svc.exe`, the signature verification path resolution failure should be handled as a non-fatal warning in service mode (same as interactive mode), rather than terminating the service. The code path already exists — it just needs to apply in both execution contexts.

## Related Issues

- #27010 — CoworkVMService access denied / WinNAT issues
- #25419 — sandbox-helper unmount / VM service won't start
- #31703 — VM service crashes with "Connection closed before response"
- #25663 — Cowork bricked after Chrome automation

Steps to Reproduce

Steps to Reproduce

1. Install Claude Desktop v1.1.8359.0 on Windows 11 Pro 25H2
2. Open Claude Desktop and navigate to Cowork
3. Observe error: "Failed to start Claude's workspace — VM service not running"
4. Confirm service fails: Start-Service CoworkVMService returns "Failed to start service"

Claude Model

None

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

PS C:\WINDOWS\system32> claude --version 2.1.63 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

_No response_