The Cowork architecture page documents subscribeEvents as
the sole unauthenticated method on the cowork-svc named pipe: any local process can
subscribe and receive real-time stdout, stderr, exit, and network events from whatever
the VM is running. This page documents the composition of that open channel with the
MCP server surface — a composition demonstrated by the March 14, 2026 investigation
on DESKTOP-B7SG880.
Every cowork-svc method except subscribeEvents requires mutual TLS with
the Anthropic-signed claude.exe certificate (thumbprint
dbde5d16768ed0c1). subscribeEvents accepts connections from
any local process. A subscriber receives the full event stream:
The stream content includes AI responses generated by the model, code execution output, file contents read by tools, credentials written to stdout, and any other output from processes running in the VM — without authentication.
MCP servers are Node.js processes spawned by claude.exe on the host.
They run at user privilege, in the same local context as cowork-svc.exe.
Any local process can open a connection to the cowork-svc named pipe and call
subscribeEvents.
This means: any MCP server running on the host can subscribe to the full VM event stream. No special privilege, no certificate, no additional access required. The condition is only that the MCP server runs locally — which is the definition of an MCP server.
\\.\pipe\cowork-vm-servicesubscribeEvents — succeeds with no authenticationOn March 14, 2026 (session 45f8071f), 16 files were found injected into tool-cdn on DESKTOP-B7SG880. Tool-cdn is the MCP server installation used by that machine's Claude Desktop. The 16 files included modified versions of the MCP server entrypoints — files that would be executed by claude.exe as MCP server processes. The injection vector was the MCP server installation itself. A compromised tool-cdn MCP server on that machine had local process access and could have subscribed to the event stream.
| Event type | Content | Security implication |
|---|---|---|
| stdout | Everything a VM process writes to standard output | AI completions, tool outputs, file contents, API responses |
| stderr | Error and diagnostic output | Stack traces, configuration paths, internal state |
| exit | Process exit code and signal | Execution timeline, failure modes |
| networkStatus | Connectivity events | Network topology, timing patterns |
| apiReachability | API endpoint reachability | Which services the VM can reach |
The cowork-svc pipe presents two distinct capability surfaces with different authentication requirements:
| Surface | Authentication | What it provides |
|---|---|---|
| Command (all methods except subscribeEvents) | Mutual TLS — Anthropic-signed claude.exe cert required | Create VMs, spawn processes, read files, mount paths |
| Observation (subscribeEvents) | None — any local process | Full real-time output of all running VM processes |
The cert architecture answers "who can act" but explicitly does not apply to observation. A process that cannot create a VM or spawn a process can still receive the complete output of every process that is running.
subscribeEvents still accepts connections. The unauthenticated
observation endpoint is present regardless of whether the VM capability is active.