[BUG] Cowork/Code VM leaks host file descriptors (~400k) until macOS exhausts kern.maxfiles and panics/reboots

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Environment: macOS 26.4 (Darwin 25.4.0), Apple Silicon, Claude Desktop with Cowork. Connected folder: /development (~300k files).

Symptom: The Apple Virtualization VM that Cowork/Code launches accumulates host-side open file descriptors continuously, including while completely idle. A preserved pressure snapshot showed the VM process holding ~409,600 fds — about 71% of the system total (kern.maxfiles) and roughly 130x the next-largest process. The count keeps growing with no prompt running; one occurrence hit 12 hours after the last prompt. When the system-wide limit is exhausted, macOS panics and reboots. Quitting Claude Desktop releases the descriptors. This happens 1–5x per day if not caught manually.

Guest side is clean: inside the VM, /proc/sys/fs/file-nr reports ~512 open files and ~5 processes shortly after boot, so the leak is in the host-side VM process — most likely the virtiofs / shared-folder layer not releasing host handles for files the guest has touched.

Process coalition: associated with Claude, not Docker. Codex/Node processes were also present (~106k fds in an earlier snapshot) but were a secondary contributor, not the dominant holder.

Workarounds found: Cmd+Q Claude Desktop; kill the VM PID (Claude relaunches it on next use); connect a smaller subfolder.

What Should Happen?

The VM should release host file descriptors when the guest closes files and when a session ends, keeping the fd count bounded. An idle VM should not grow its fd usage, and the app should never be able to push the host past kern.maxfiles.

Error Messages/Logs

Pressure snapshot (host, macOS):
  Claude-owned Apple Virtualization VM: ~409,600 open file descriptors (~71% of kern.maxfiles, ~130x next-largest process)
  Codex/Node (hundreds of processes): ~106,000 fds in an earlier snapshot (secondary)

Inside the VM (guest) at boot:
  /proc/sys/fs/file-nr -> 512 0 ...
  5 processes, top process holds 4 fds
  uptime 2 min

Outcome: system-wide fd exhaustion -> macOS kernel panic -> reboot

Steps to Reproduce

1. On macOS 26.4 (Apple Silicon), open Claude Desktop and start a Cowork session with a large folder connected (~300k files, e.g. a /development tree).
2. Run a few prompts that touch files, then leave the app open and idle.
3. Watch host fd usage: sudo lsof -n | awk '{print $2}' | sort | uniq -c | sort -rn | head -5 — the VM process climbs steadily over hours.
4. Leave it long enough (hours; observed up to 12h after the last prompt) and the fd count reaches the system limit; macOS panics and reboots.
5. Cmd+Q Claude Desktop before that point and the descriptors are released immediately.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

Claude Desktop (Cowork/Code VM), current release as of 2026-09-06 — not the CLI

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

• Claude session start times match the VM's launch time, and Claude died during the final collapse.
• Multiple Cowork sessions may have the same folder connected concurrently.
• Existing VM reports (#26087, #47829, #26646, #65239, #47644) cover guest kernel panics and disk-write limits, not host fd exhaustion.
• Claude Code run from Terminal (no VM) does not exhibit this.