The sandbox issues on Windows
Issues the maintainers labelled both platform:windows and area:sandbox.
115 issues · 54 open · 61 resolved (53%) · first seen Feb 26, 2026
Is this getting better or worse?
This class of problem is still growing. 57 new reports in the last 90 days vs 45 in the 90 before — +27%. The open backlog peaked at 54 in 2026-10 and sits at 54 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
47 of these reports name the Claude Code build they were running, spanning 41 releases. Heaviest reporters:
- Claude Code v2.1.220
- Claude Code v2.1.267
- Claude Code v2.1.260
- Claude Code v2.1.197
- Claude Code v2.1.98
- Claude Code v2.1.92
- Claude Code v2.1.293
- Claude Code v2.1.286
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 39 days across 61 closures. Of the 61 closures with a recorded reason, 11% were closed as completed and 54 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
44 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] Cowork on Windows: bash sandbox can create files on mounted host folder but unlink is denied — breaks all git write operations
- …eyboards were destroyed in the repeated attempts to explore workarounds. When using Claude Code (Desktop and CLI) I did not hit this issue. Bummer, as I'm enjoying Cowork Desktop and am excited to see this resolved. I ha…
Found in the thread of #55206 · still open - [BUG] RPC error: useradd failed (exit status 12) — cannot start any new Cowork tasks
- FYI following the workaround: Workaround Fully quit Claude Desktop mv "~/Library/Application Support/Claude/vm bundles/claudevm.bundle/sessiondata.img" ~/Desktop/sessiondata.img.bak Restart Claude Desktop (recreates the…
Found in the thread of #36465 · resolved - Read tool PDF support broken on Windows — sandbox rejects pdftoppm from all locations
- …rShell within the same Claude Code session works perfectly: Workaround Two-step process via Bash: 1. Convert PDF to PNG: 2. Read the PNG with the Read tool This works reliably but requires extra Bash permission prompts a…
Found in the description of #65089 · resolved - [Bug] Claude Desktop VM workspace startup failure: path mismatch between AppData\Roaming and AppData\Local
- …ical - bash/workspace entirely unavailable Status Resolved (workaround applied) --- Summary After a Claude Desktop update, the Cowork bash/workspace sandbox failed to start on every session. The Linux VM could not be ini…
Found in the description of #56542 · resolved - [BUG] Claude-spawned child shells on Windows can't complete new outbound TLS handshakes to non-Anthropic endpoints (breaks Perforce)
- …another. Some state or configuration drives the enablement. Workaround Route p4 commands through WMI to spawn them outside Claude's process tree: $outFile = "C:\Users<USERNAME \AppData\Local\Temp\claude-p4-out.txt" if(Te…
Found in the description of #68219 · still open
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 1–100
Ranked by community engagement (reactions weighted over comments).
- [Feature Request] Native sandbox support for Windows (non-WSL)
- [BUG] Cowork on Windows: bash sandbox can create files on mounted host folder but unlink is denied — breaks all git write operations
- [BUG] RPC error: useradd failed (exit status 12) — cannot start any new Cowork tasks
- [BUG] Cowork local sandbox not mounting after update in Claude Desktop 1.49585.0.0 (Windows)
- Read tool PDF support broken on Windows — sandbox rejects pdftoppm from all locations
- [Bug] Claude Desktop VM workspace startup failure: path mismatch between AppData\Roaming and AppData\Local
- [BUG] Claude-spawned child shells on Windows can't complete new outbound TLS handshakes to non-Anthropic endpoints (breaks Perforce)
- Support Microsoft MXC sandboxing
- [BUG] Cowork stale-cache corruption reproduced under Claude Fable 5 — host writes are clean on disk, the sandbox read view truncates (full diagnosis + fix)
- [Bug] Linux sandbox unavailable: bash hard failure preventing tool execution
- [Bug] virtiofs mount serves truncated file contents to sandboxed environment while host files are clean
- [BUG] Cowork Windows 10 22H2 x64: `sandbox-helper: no Plan9 drive shares mounted` — device_bash dead since 2026-09-08, survives app restart and app update
- [BUG] Cowork /sessions never garbage-collects session directories (2,328 stale dirs, disk at 100%, unrecoverable from sandbox)
- PowerShell tool: non-overridable "Remove-Item on system path" guard over-blocks legitimate commands (AST target mis-attribution)
- [BUG] Cowork sandbox VM bundle not found in Roaming path on Windows 10 Pro (Store/AppX install) — hardlink workaround
- [BUG] Browser pane blocks all subresources from a PUBLIC internet domain with ERR_BLOCKED_BY_CLIENT (same symptom as #87472, but not an RFC1918 address)
- [BUG] Windows sandbox breaks Gradle/JVM loopback IPC ("Unable to establish loopback connection") — still repros on 2.1.209 (#44857 closed without fix)
- Worktree sessions can edit files in the parent main checkout with no guardrail
- Claude Desktop MSIX (v1.52386.0): Workspace fails to start — VHDX not found + junction redirect rejected, even after clean reinstall
- [BUG] Cowork sandbox fails at sdk_install on Windows — VM guest crashes with "connection forcibly closed" (regression SDK 2.1.181 → 2.1.202)
- dangerouslyDisableSandbox allows the model to bypass workspace boundaries without a distinct, explicit user confirmation
- [BUG] Cowork scheduled task reads stale filesystem snapshot between invocations (Windows)
- [BUG] Windows: ENOENT mkdir 'E:\claude-tmp\...\tasks' — all Bash tool calls fail
- [BUG] Virtualization is not available Claude's workspace requires Virtual Machine Platform, but the virtualization service isn't responding. Restart your computer to resolve this.
- Claude Code deleted ~600GB: unprompted `rm -rf` on a substitution that resolved to a drive root
- [BUG] [Cowork] mcp__workspace__bash sandbox VM still fails to start — 2-month persistent outage (ref #76374)
- Read() deny rule on a root file makes every `grep -r .` prompt under bypassPermissions (2.1.257 reader-command rule, untouched by the 2.1.260 revert)
- Bug Report: Linux sandbox fails to start on Windows 10 (RPC pipe closed) — MSIX identity detection bug
- Native Windows: working directory does not scope shell-tool filesystem access
- [BUG] Hanging find.exe
- [BUG] Cowork: virtiofs mount cache not invalidated on Windows host file saves — BadZipFile on Excel save (ref #42520)
- [Cowork] Sandbox disk stuck at 100% full, not cleared by app or PC restart
- Auto mode still triggers permission prompts for PowerShell registry writes on Windows
- [BUG] Cowork: Agent autonomously explores filesystem outside sandbox boundary (Windows 11)
- [BUG] rm -rf with unexpanded ${LOCALAPPDATA} in bypassPermissions deletes real system directory
- [BUG] Cowork sandbox VM leaks on Windows - orphaned vmmem/vmwp (cowork-vm-*) keeps running after app quit
- [BUG] Cowork sandbox bash tool caps timeout_ms at 45000, no way to run longer commands
- [BUG] Cowork: mount serves null bytes for rename target after recreating rename-source path — git unusable on mounted folders
- [MODEL] opus
- [BUG] Cowork fails with Plan9 share 'd': HRESULT 0x80070005 - Windows (Microsoft Store install)
- [SOLUTION] RPC error -1: virtiofs mount Plan9 mount failed: bad address — Working Recovery Script + Fix Pattern (Windows 11 Pro)
- [BUG] Cowork mode sandbox stuck — Bash tool fails to mount virtiofs share repeatedly (Windows)
- Claude Code bypassed a blocked system-path guard via 'cmd /c rd', then a destructive command silently continued unsupervised in the background after timeout — wiped C:\ drive root
- [BUG] Windows 11: Write tool and Bash tool cannot write files visible to the real file system
- [BUG] `codex_sandbox` firewall rules cause intermittent ECONNRESET in VS Code extension (Windows)
- [FEATURE] I would like to be able to run the claude windows app as a different user
- [BUG] Claude wrote files to system temp folder (AppData\Local\Temp) without disclosure
- [Bug] Sub-agent `rm -rf` with case-insensitive path collision destroys workspace; no sandbox, confirmation, or orchestrator interception
- Sandbox blocks tmux (psmux) when cwd is home directory on Windows
- [BUG] sandbox.filesystem.allowWrite not enforced when using --dangerously-skip-permissions
- [BUG] Windows: sandbox bash ignores CLAUDE_CODE_SHELL and sandbox.enabled: false (v2.1.59)
- [BUG] Subagent ran rm -rf \ via PowerShell → MSYS2 bash (PowerShell expanded the escaped variables to empty), wiping C:\ top-down on Windows
- [BUG] [Desktop App 3P] Mapped network drive is attached to the VM but never exposed to the session shell (Windows)
- Model destroyed a 410KB user file: open(path,"w") truncated it, then the write threw
- Windows: Remove-Item guard blocks any command containing a path with a space
- [BUG] Claude Code 2.1.261 crashes
- Agent tool: isolation:"worktree" subagent read parent session's private transcript outside its worktree
- Native Windows: working directory does not scope shell-tool filesystem access
- (Bug) Terminal tool spawns Gradle/Java processes that fail loopback handshake — Unable to establish loopback connection
- [BUG] PowerShell guard blocks Remove-Item for any direct child of a drive root, including nonexistent paths
- Windows desktop app: projects, memory, and sandboxing are invisible or missing - field report from shipping a real product through it
- [Cowork] mcp__workspace__bash sandbox VM fails to start — persistent multi-session outage
- [BUG]
- [BUG] Claude Code create c:/memfs directory without asking me.
- [BUG] Files over some size threshold (in my skill's case, a file >614 lines / >23,458 bytes) get cut off in the Linux-sandbox view, preventing skill from executing on Windows
- [BUG] Claude-spawned child shells on Windows can't complete new outbound TLS handshakes to non-Anthropic endpoints (breaks Perforce)
- [BUG] Bash tool bypasses configured working directory boundaries
- Sandbox denies user-approved Management API PATCH even after explicit AskUserQuestion authorization
- [BUG] CoWork: Edit tool silently hangs on /mnt/.claude/ (read-only mount) — no error, turn produces no output
- [BUG] Cowork Windows: bwrap sandbox torn down between turns, killing background processes (works on Mac)
- [BUG] Process gets killed with SIGTERM ~90 seconds later ❌
- [BUG] Built-in "dangerous rm" safety check is spelling-dependent: the MSYS /d/… form of a top-level path raises no approval gate
- [CRITICAL] Sub-agent ran `rm -rf` on the user's Windows home directory (via 8.3 short name), no hard guard; delete kept running after the task was stopped
- [BUG] Windows: sub-agent rm -rf on the 8.3 short-name alias of the home dir wiped ~116 GB; TaskStop left it running ~50 min; agent reported 'looks intact' (related: #92593, #95426, #97660)
- Worktree-isolated subagent cannot create a directory link: cmd/powershell refused, Git Bash ln -s silently deep-copies (FB-033)
- [Windows] Stray/truncated files caused by a third-party hook (`cmd.exe /d /c …` mangled by Git Bash, cmd executes hook JSON) — not a Read/Edit or model shell bug
- [FEATURE] Desktop local sessions: scoped permission profile, and an explained rather than hidden sandbox row on Windows (successor to #81121)
- [BUG] Cowork Windows: sandbox VM disk (rootfs.vhdx) hits a hard 10 GiB cap every 1–2 weeks and kills bash with "No space left on device"; recovery service doesn't restart itself after a crash
- Scheduled Tasks: bash sandbox mount failing intermittently since 2026-09-08 (Windows)
- [BUG] Windows desktop (MSIX): writes to %LOCALAPPDATA% from Claude Code sessions are silently redirected to Packages\Claude_*\LocalCache
- Agent bypassed a Remove-Item safety block by switching to cmd's rmdir, then a quoting bug deleted ~10,000 files (project source, data, and personal automation scripts)
- [BUG] Cowork sandbox cannot mount any connected folder on Windows
- [BUG] Claude Desktop (Cowork) on Windows 11: Linux sandbox fails to start — Plan9 share "c" not mounted after KB5124008
- [BUG] Bash/PowerShell tool execution broken mid-session — basic binaries missing (ssh, ls, which)
- [BUG] Desktop app: sessions read a stale, isolated filesystem view that never re-syncs
- PowerShell safety guard: Spanish word "del" inside a quoted commit message is treated as Remove-Item, then blocks on a quote-split path fragment
- [BUG] Linux sandbox stuck on "Workspace still starting" forever on Windows 11 (Cowork/Code)
- Worktree command-safety analyzer misreads a non-leading `complete`/`compgen`/`compopt` token as an invoked builtin
- auto-mode classifier did not block an agent-authored script that ran `git clean -xdff` at the workspace root (21 projects destroyed, native Windows)
- Sub-agent ran recursive delete outside working dir, wiped entire user profile (~235k files); safety classifier failed open
- [BUG] Managed.settings.json & settings.json
- [FEATURE] Workspace boundary enforcement for local file writes — auto mode allows out-of-workspace Bash writes silently; recommended alternative (sandbox) unavailable on native Windows
- [BUG] Cowork sandbox mount serves recently-grown files truncated to a stale cached size
- Sandbox mode blocks named pipe creation on native Windows (EACCES), contradicting docs that say sandboxing is WSL2-only
- [BUG] Sandbox bash mount returns truncated/partial file reads (Cowork mode)
- Bash tool blocked (even read-only) when safety-classifier model is unavailable; dangerouslyDisableSandbox does not override
- Windows: Write/Edit tools fail with spurious EEXIST on sandboxed workspace (bindflt/bfs mount) — temp file does not exist
- why my claude can not use my terminal
- [BUG] Cowork (Windows, cloud session): mapped network drive attached via folder picker works with file tools but is never mounted into the sandbox shell — breaks NAS workflows before Oct 6 removal of local-only mode
- [feedback] silent-side-effects: A missed twin-patch let a route write the real reports/pipeline_state.json during a green test;