[BUG] Cowork "RPC pipe closed" on Windows 11 — shipped claude.exe fails Authenticode check (HashMismatch), reinstall path disabled

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Environment

Claude Desktop 1.37937.3.0, Windows 11 Pro x64.
Package installed on C: (C:\Program Files\WindowsApps\Claude_1.37937.3.0_x64__pzs8sxrjxfjjc).
Windows Defender only; no third-party AV or endpoint agent.

What's wrong

Cowork fails to start with "Failed to start Claude's workspace / RPC pipe closed".
CoworkVMService, vmcompute, hns and vmms are all Running. Virtualization stack is healthy.

Logs show the real cause is a client Authenticode check that the shipped binary cannot pass:

[vm-client] Event subscription ack failed: Error: signature verification failed:
client executable is not signed:
C:\Program Files\WindowsApps\Claude_1.37937.3.0_x64__pzs8sxrjxfjjc\app\claude.exe
[VM:start] Startup failed: Error: RPC pipe closed
code: 'ERR_VM_PIPE_CLOSED'
[VM:start] Skipping auto-reinstall (service transport error), leaving VM offline

Evidence the binary as shipped is the problem

Get-AuthenticodeSignature on claude.exe returns HashMismatch.
All 12 other signed binaries in the same package return Valid, including cowork-svc.exe:

Name Status Modified
chrome-native-host.exe Valid 27-08-26 3.30.30 AM
cowork-svc.exe Valid 27-08-26 3.30.30 AM
d3dcompiler_47.dll Valid 27-08-26 3.30.29 AM
dxcompiler.dll Valid 27-08-26 3.30.29 AM
dxil.dll Valid 27-08-26 3.30.29 AM
ffmpeg.dll Valid 27-08-26 3.30.29 AM
github-mcp-server.exe Valid 27-08-26 3.30.30 AM
libEGL.dll Valid 27-08-26 3.30.29 AM
libGLESv2.dll Valid 27-08-26 3.30.29 AM
msalruntime.dll Valid 27-08-26 3.30.30 AM
vk_swiftshader.dll Valid 27-08-26 3.30.35 AM
vulkan-1.dll Valid 27-08-26 3.30.35 AM
claude.exe HashMismatch 27-08-26 3.30.29 AM

claude.exe shares the same install timestamp as every sibling, so this is an
install-time state, not later modification.

Certificate chain is healthy — not a trust problem:
certutil -verify -urlfetch passes; EV cert valid to 2026-10-21; CRL and OCSP both verified;
"Leaf certificate revocation check passed".

Get-AppxPackage reports Status: Ok.
Get-MpThreatDetection shows no detections involving Claude.

This suggests claude.exe is signed before MSIX packaging and then modified during packaging,
invalidating its embedded Authenticode while the package-level signature stays valid.

Regression

Cowork worked on 1.34493.1.0 (bash calls executing normally in logs through 23 Aug 2026).
Fails identically on 1.37937.1.0 and 1.37937.3.0.

Three separate defects

1. The shipped claude.exe cannot pass the Authenticode check cowork-svc.exe enforces on it.
2. The failure surfaces only as a generic ERR_VM_PIPE_CLOSED with no mention of signatures.
3. The same transport error triggers "Skipping auto-reinstall", disabling the one recovery

path the UI offers, so the Reinstall workspace button can never succeed.

Expected

Cowork starts. Failing that, the error should name the signature check, and the reinstall
path should not be gated behind the error it exists to recover from.

What Should Happen?

Cowork should start the workspace VM and become usable.

Failing that, the error shown should name the signature verification failure
instead of a generic "RPC pipe closed", and the "Reinstall the workspace"
button should not be disabled by the same error it exists to recover from.

Error Messages/Logs

2026-08-28 10:02:56 [warn] [vm-client] Event subscription ack failed: Error: signature verification failed: client executable is not signed: C:\Program Files\WindowsApps\Claude_1.37937.3.0_x64__pzs8sxrjxfjjc\app\claude.exe
2026-08-28 10:02:56 [info] [VM:start] Configuring Windows VM service...
2026-08-28 10:02:56 [error] [VM:start] Startup failed: Error: RPC pipe closed
  code: 'ERR_VM_PIPE_CLOSED'
2026-08-28 10:02:56 [warn] [VM:start] Skipping auto-reinstall (service transport error), leaving VM offline

Steps to Reproduce

1. Install Claude Desktop 1.37937.3.0 on Windows 11 Pro x64 (default C: location).
2. Open the Cowork tab.
3. Error appears: "Failed to start Claude's workspace / RPC pipe closed".
4. Click "Reinstall the workspace" - it does not fix the error.
5. In PowerShell, run:

Get-AuthenticodeSignature "C:\Program Files\WindowsApps\Claude_1.37937.3.0_x64__pzs8sxrjxfjjc\app\claude.exe"
Result: HashMismatch. Every other signed binary in the same package returns Valid.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

1.34493.1.0

Claude Code Version

N/A - this is Claude Desktop 1.37937.3.0, not Claude Code CLI

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

Ruled out during diagnosis:

• Not the non-C: drive install bug (#86825) - package is on C:
• CoworkVMService, vmcompute, hns and vmms all Running
• Windows 11 Pro (full Hyper-V stack present)
• Windows Defender only, no third-party AV; no detections involving Claude
• Certificate chain fully valid, revocation check passed
• Distinct from #32186 (service failed to start there; here it starts and rejects the client)