VibeGHSA-v234-4jrq-mgg6: Claude Desktop on macOS could run a file an agent left in a Cowork folder
Summary
Anthropic published advisory GHSA-v234-4jrq-mgg6 for Claude Desktop on macOS. Claude Desktop blocks file types that execute on open from being opened straight from a Cowork shared folder, but the macOS list missed one such type. A file placed there by a compromised or prompt-injected agent could run commands on the Mac if the user opened it from Claude Desktop. Versions from 1.1.3918 up to but not including 1.15962.0 are affected; 1.15962.0 fixes it. Anthropic scores it CVSS 4.0 8.5 and says auto-updating users already have the fix. No CVE is listed yet.
Severity
Timeline
Claude Desktop 1.11847.5 updates the Cowork VM to a patched Linux kernel, fixing a separate upstream kernel flaw named in the advisory that, combined with this one, could have triggered the file open without the user.
Anthropic publishes GHSA-v234-4jrq-mgg6: affected 1.1.3918 to before 1.15962.0, fixed in 1.15962.0.
How it happened
Cowork lets an agent work inside a sandboxed VM that shares a folder with the Mac. Claude Desktop keeps a block list of file types that run code when opened, so agent-written files cannot run on the host by accident. On macOS the list left out one such type (Anthropic does not name it). Anthropic classifies it as CWE-184 (Incomplete List of Disallowed Inputs). Anthropic says it found the issue internally and that Vladimir Tokarev of Cyera Research also reported it independently.
How to check your app
- Make sure Claude Desktop on macOS is 1.15962.0 or later, especially on managed or manually updated machines.
- Do not open files an agent created in a Cowork folder unless you know what they are.
- Treat agent output as untrusted when the agent has read web pages or other outside content.