[BUG] [Windows] Claude Desktop spawns exponentially self-replicating git.exe processes that continue after app closes (~7,500 processes in minutes)

Summary

On Windows 11, opening Claude Desktop (Windows app) triggers git.exe processes that recursively spawn themselves in an exponential pattern, reaching 7,000+ processes within minutes. The runaway git.exe processes continue spawning even after Claude.exe is fully terminated — only uninstalling Claude Desktop completely stops the process explosion. taskkill and WMI-based termination cannot keep up with the spawn rate.

This is a critical bug that can exhaust system resources (Non-Paged Pool, TCP/UDP ports, handle tables) and destabilize the OS — in my case, WSL failed to start after the incident and required a reboot to recover.

---

Environment

• OS: Windows 11
• Shell: PowerShell 7.6.0 (running as Administrator)
• Git: Git for Windows (standard install)
• Claude Desktop: Latest version as of April 2026 (Opus 4.7 1M available in-app)
• NOT installed: Claude Code CLI, Claude Code VS Code extension, any Claude-related VS Code / Cursor extensions
• No Claude-related startup items in Win32_StartupCommand
• No .claude/settings.json or .claude-mem/settings.json on disk
• where.exe claude returns nothing (no CLI / PATH hijacking)

---

Steps to Reproduce

1. Install Claude Desktop on Windows 11 (standard installer, bundles Cowork / agent mode)
2. Open Claude Desktop — chat mode works fine, claude.exe stabilizes at ~9 processes, git.exe stays at 0
3. Switch to the Code tab within Claude Desktop (the GUI with "Routines", "Local / Select folder", "Accept edits", model selector showing "Opus 4.7 1M · Extra high")
4. Observe git.exe process count explode

---

Observed Behavior

Live monitoring with:

while ($true) {
    $g = (Get-Process git -ErrorAction SilentlyContinue | Measure-Object).Count
    $c = (Get-Process claude -ErrorAction SilentlyContinue | Measure-Object).Count
    "$(Get-Date -Format 'HH:mm:ss') - git: $g, claude: $c"
    Start-Sleep -Seconds 3
}

Phase 1: Chat mode only (safe)

19:50:10 - git: 0,  claude: 0   ← before launch
19:50:22 - git: 0,  claude: 2   ← Claude Desktop starts
19:50:28 - git: 0,  claude: 9   ← stable chat mode
19:51:17 - git: 0,  claude: 9   ← still stable after 1+ minute

Phase 2: Opening the Code tab triggers fork bomb

19:51:20 - git: 42,   claude: 10   ← Code tab opened
19:51:23 - git: 250,  claude: 10   ← +208 in 3 seconds
19:51:26 - git: 438,  claude: 9
19:51:29 - git: 629,  claude: 9
19:51:35 - git: 995,  claude: 9
19:51:44 - git: 1514, claude: 9
19:51:56 - git: 2115, claude: 9

Phase 3: Claude closed, git.exe continues to multiply

After closing Claude Desktop window (claude.exe count drops to 0), git.exe continues to grow:

19:52:44 - git: 1581, claude: 0   ← Claude fully closed
19:52:50 - git: 1880, claude: 0   ← git still growing without a parent claude.exe!
19:53:15 - git: 2885, claude: 0
19:54:04 - git: 4633, claude: 0
19:55:02 - git: 6141, claude: 0
19:56:13 - git: 7531, claude: 0   ← ~7,500 zombie git processes

Phase 4: Uninstalling Claude Desktop immediately stops the spawn

19:56:13 - git: 7531, claude: 0   ← uninstall in progress
19:56:17 - git: 508,  claude: 0   ← uninstall completes, spawn stops
19:56:20 - git: 0,    claude: 0   ← cleanup complete
19:56:32 - git: 0,    claude: 0   ← stable

The moment Windows "Apps → Installed apps" reported the Claude app gone, git.exe went from 7,531 → 0 within 3 seconds.

---

Process Command Line Signature

All runaway git.exe processes share this exact command line:

git.exe -c core.hooksPath=/dev/null -c safe.directory=* --version

---

Process Tree Analysis

Using Get-CimInstance Win32_Process -Filter "Name='git.exe'" during the incident, the parent process of nearly every git.exe is another git.exe, forming a self-referential chain:

ProcessId  ParentProcessId  CommandLine
---------  ---------------  -----------
265384     265476           git.exe -c core.hooksPath=/dev/null -c safe.directory=* --version
265316     265384           git.exe -c core.hooksPath=/dev/null -c safe.directory=* --version
250884     265316           git.exe -c core.hooksPath=/dev/null -c safe.directory=* --version
250996     250884           git.exe -c core.hooksPath=/dev/null -c safe.directory=* --version
233792     250996           git.exe -c core.hooksPath=/dev/null -c safe.directory=* --version
42560      233792           git.exe -c core.hooksPath=/dev/null -c safe.directory=* --version
... (thousands more, same pattern)

Each git.exe spawns approximately 1 new git.exe every 20–50 ms, giving exponential growth of ~100–200 new processes per 3-second observation window.

---

Expected Behavior

• A single git --version probe should execute, return, and terminate cleanly
• Closing Claude Desktop should terminate all child processes it spawned
• No recursive self-spawning should occur under any condition
• No process should survive after the parent app is uninstalled

---

Attempted Mitigations (all failed while Claude Desktop was installed)

• taskkill /f /im git.exe — kills a batch, but new processes spawn faster than kill can keep up
• Loop: for ($i=0; $i -lt 20; $i++) { taskkill /f /im git.exe 2>$null; Start-Sleep -Milliseconds 300 } — same problem
• WMI Terminate: Get-CimInstance Win32_Process -Filter "Name='git.exe'" | ForEach-Object { Invoke-CimMethod -InputObject $_ -MethodName Terminate } — same problem
• Closing Claude Desktop window — claude.exe terminates but git.exe continues multiplying indefinitely
• Only uninstalling Claude Desktop via Settings → Apps → Installed apps actually stopped the spawn.

---

System Impact

• Non-Paged Pool exhaustion: After the first incident of this bug, WSL failed to start (wsl command hangs indefinitely). A full system reboot was required to restore WSL functionality. This matches the symptoms reported in issue #42169.
• Potential UDP port / handle table saturation if the bug runs long enough
• Risk of system instability (DWM crash, Windows Terminal crash) matching similar issues

---

Hypothesis

The -c core.hooksPath=/dev/null -c safe.directory=* flags suggest this is Claude Desktop's (or the bundled Cowork agent's) git environment probe, specifically designed to be non-recursive by disabling hooks and bypassing the safe-directory check. However, on this system the probe enters an infinite spawn loop.

The fact that git.exe continues multiplying after claude.exe is fully terminated strongly suggests one of:

1. A detached background worker (Windows Scheduled Task, service, or orphaned child) continues invoking git
2. A Cowork/agent helper process that outlives the main Electron shell
3. Some form of retry/spawn logic in a git wrapper that Claude Desktop installs

The uninstall-stops-everything behavior further suggests the mechanism is tied to a registered Windows component that uninstall removes.

---

Suggested Investigation

1. Audit every Claude Desktop / Cowork component that invokes git.exe -c core.hooksPath=/dev/null -c safe.directory=* --version — why does it retry recursively, and why does it survive the main claude.exe process?
2. Check whether Claude Desktop / Cowork registers a Windows Scheduled Task, background service, or native Windows component that continues running after the main app closes
3. Verify that the git probe has a hard retry limit and cannot self-invoke
4. Ensure the Code tab's "Local folder" scanning path has a recursion guard and a spawn-rate limit
5. Confirm that closing the main window performs full child-process cleanup (including any detached helpers)

---

Related Issues

• #42169 — claude.exe accumulates 13+ GB virtual memory, triggers Windows Resource Exhaustion (same Non-Paged Pool symptom)
• #36929 — [Windows] claude.exe spawns multiple processes, consuming ~4.8 GB RAM at idle
• #32792 — [BUG] [Windows] Multiple claude.exe processes spawn each time Claude Code panel is opened
• #29045 — [BUG] Claude Desktop spawns 1.8 GB Hyper-V VM on every launch, even for chat-only use

This issue appears to be a more severe escalation of the Windows-specific process-management problems documented across these reports.

---

Workaround

Until fixed: do not open the Code tab in Claude Desktop on Windows. Chat mode alone is safe (no git probing observed). If the fork bomb is triggered, the only reliable way to stop it is to uninstall Claude Desktop entirely.

---

Severity

Critical. A single accidental click on the Code tab can exhaust system resources within minutes and destabilize other system components (WSL, Hyper-V, possibly more). Average users cannot self-diagnose this — it presents as "my computer got slow and WSL broke after installing Claude."