Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

Environment:

• Claude Desktop: 1.1.2685 (MSIX/Windows Store)
• OS: Windows 10 Pro
• Hyper-V: Enabled (full, not Home edition)
• VPN software installed: Yes (was fully stopped during testing)
• Docker Desktop: Installed but stopped

Problem:
Cowork consistently fails with "Failed to start Claude's workspace — Can't reach the Claude API from Claude's workspace." The Cowork Hyper-V VM boots and connects to the host over vEthernet (cowork-vm-nat) on 172.16.0.0/24, but cannot reach the external internet to contact api.anthropic.com. Regular Chat mode works perfectly.

Root cause investigation:

1. The app creates an HNS network (cowork-vm-nat, type: NAT, subnet: 172.16.0.0/24, gateway: 172.16.0.1) but does NOT create a corresponding WinNAT rule (Get-NetNat returns empty).
2. IP Forwarding is NOT enabled on vEthernet (cowork-vm-nat).
3. Without NAT + forwarding, the VM can reach the host but has no route to the internet.
4. Manually creating the NAT rule (New-NetNat) and enabling forwarding does not persist — the app recreates the HNS network on restart without the WinNAT rule.
5. The host machine can reach api.anthropic.com without issues (port 443, DNS, TLS all verified).

What Should Happen?

The app should create both the HNS network AND the corresponding WinNAT rule (New-NetNat), and enable IP forwarding on the vEthernet (cowork-vm-nat) virtual adapter. The Cowork VM should be able to reach api.anthropic.com through the host's internet connection.

Error Messages/Logs

From cowork_vm_node.log — every startup attempt shows this pattern:

[VM] Network status: NOT_CONNECTED
[VM:network] Not connected, will show error in 30000ms if not resolved
[VM] Network status: CONNECTED
[VM] API reachability: PROBABLY_UNREACHABLE
[VM] API reachability: UNREACHABLE
[VM:network] API is unreachable

Network diagnostics from host:
- Get-NetNat returns empty (no WinNAT rule exists)
- Get-NetIPInterface shows Forwarding=Disabled on vEthernet (cowork-vm-nat)
- Get-HnsNetwork shows cowork-vm-nat exists (type: NAT, 172.16.0.0/24) but without WinNAT backing
- Host can reach api.anthropic.com on port 443 (TLS succeeds, DNS resolves)

Steps to Reproduce

1. Install Claude Desktop (MSIX/Windows Store) on Windows 10 Pro with Hyper-V enabled
2. Open Claude Desktop and navigate to Cowork
3. Attempt any task in Cowork
4. Observe "Failed to start Claude's workspace — Can't reach the Claude API from Claude's workspace"
5. Verify host can reach api.anthropic.com (it can)
6. Check Get-NetNat in admin PowerShell — returns empty
7. Check Get-HnsNetwork — shows cowork-vm-nat exists as type NAT but no WinNAT backing
8. Check Get-NetIPInterface -InterfaceAlias "vEthernet (cowork-vm-nat)" — Forwarding=Disabled

Claude Model

None

Is this a regression?

No, this never worked

Last Working Version

No response

Claude Code Version

2.1.34 (Claude Code in Cowork VM) / Claude Desktop 1.1.2685 (MSIX)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

This appears to be a Day 1 issue with Cowork on Windows (launched Feb 10, 2026). Possibly related to #24918.

Manually creating the NAT rule and enabling forwarding via admin PowerShell temporarily allows the VM to work, but Claude Desktop recreates the HNS network on restart without re-establishing the WinNAT rule, so the fix does not persist.

VPN software (ExpressVPN) was installed but fully stopped during all testing — same result with or without it running.