CLAUDE DESKTOP · GHSA-v234-4jrq-mgg6 · AI agents & MCP
FIX → 1.15962.0
Claude Desktop's block list omitted a file type that macOS executes on open, so a file written into a Cowork shared folder by a compromised or prompt-injected agent could run commands on the Mac when the user opens it from Claude Desktop. The advisory also notes a combined chain with a guest Linux kernel flaw (CVE-2026-43284) that could trigger the open without user interaction.
first public Sep 25, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Claude Desktop on macOS, versions from 1.1.3918 up to but not including 1.15962.0, is exposed when a user opens a file from a Cowork session's shared folder. The attack needs an agent inside the Cowork sandbox to place the file, which is what a compromised or prompt-injected agent would do. Teams using Claude Desktop with Cowork on Macs should check versions; Windows and Linux are not named in the advisory.
Not affected if no-cowork-sessions, version-1.15962.0-or-later
Who cares ai-agents, claude-desktop, cowork, macos
Info.plist, and compare it with 1.15962.0.Upgrade to 1.15962.0
1.15962.0 or later (fixed version per the product data).Claude Desktop maintains a list of file types that execute code when opened, and prevents those types from being opened directly from a Cowork session's shared folder. This ensures that content written into the folder by an agent running inside the Cowork sandbox cannot execute on the host without the user intending to run it. On macOS, this list omitted a file type that the operating system executes on open. As a result, a file placed in a Cowork folder by a compromised or prompt-injected agent could run commands on the user's Mac if the user opened that file from Claude Desktop. Claude Desktop 1.15962.0 adds this and related file types to the block list.
Separately, Claude Desktop releases prior to 1.11847.5 shipped a Cowork VM image whose guest Linux kernel was affected by the upstream vulnerability CVE-2026-43284. Claude Desktop 1.11847.5 (released 9 June 2026) updated the VM image to a patched kernel. When the two issues were combined, code that had gained elevated privileges inside the VM could trigger the file open without user interaction; the severity rating above reflects the file-handling issue on its own. Claude Desktop 1.15962.0 and later include both changes.
Users on standard Claude Desktop auto-update have already received these fixes. Users performing manual or managed updates are advised to update to the latest version.
Identified internally by Anthropic. Also independently reported by Vladimir Tokarev (Cyera Research).
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
1.11847.5 shipped a VM image with the affected kernel; the advisory says 1.11847.5 updated it to a patched kernel.