Detailed Analysis
A Reddit post surfacing in r/ClaudeAI documents a technical workaround for a permissions error affecting Claude's "Cowork" virtual machine feature on Windows 10 systems. The error message—"Account does not have permission to open attachment... Access is denied (0x80070005)"—points to a Windows access control failure involving the claudevm.bundle\smol-bin.vhdx file, a virtual hard disk image located in the Claude application's AppData directory. The user-provided fix involves deleting the existing vm_bundles folder and then using Windows' icacls.exe command-line utility to explicitly grant full control (F) permissions to the security identifier S-1-5-83-0, which is a well-known Windows SID reserved for virtual machine worker processes (specifically, the "NT VIRTUAL MACHINE\Virtual Machines" group used by Hyper-V and related virtualization subsystems).
This error reveals that Claude's Cowork feature—apparently a sandboxed or virtualized execution environment bundled with the desktop Claude application—relies on Windows' native virtualization stack (likely Hyper-V or a lightweight VM technology) to run isolated workloads, using a VHDX (Virtual Hard Disk v2) file format to store the virtual machine's filesystem. The 0x80070005 "Access is denied" error is a classic Windows permissions problem that occurs when the virtual machine worker process account lacks the necessary NTFS permissions to mount or access the virtual disk file. This is a known class of issue in Hyper-V and Windows Sandbox-style deployments, where the VM host process runs under a restricted security context (the S-1-5-83-0 SID family) that doesn't automatically inherit permissions from the user account that created or downloaded the files.
The significance of this issue lies in what it reveals about Anthropic's product direction: Claude is evolving beyond a pure chat interface into an agentic system capable of executing tasks in isolated, sandboxed compute environments directly on a user's local machine. "Cowork" appears to be a feature enabling Claude to perform more autonomous, file-system-level or code-execution tasks within a secure VM boundary—likely part of Anthropic's broader push toward agentic coding and computer-use capabilities, similar in spirit to Claude Code and computer-use API features. Bundling a full virtual machine image with a desktop application is a notable architectural choice, reflecting the security-conscious design philosophy Anthropic has emphasized: isolating AI-driven code execution from the host system to limit blast radius if the model takes unintended or harmful actions.
That said, this kind of grassroots troubleshooting post—where a community member has to reverse-engineer a fix involving low-level Windows ACL commands—also highlights the friction points that come with shipping consumer-grade software that bundles enterprise-grade virtualization technology. Permissions issues tied to VM worker processes are historically finicky on Windows, often varying by OS edition, antivirus software, Hyper-V feature state, and prior installation artifacts, meaning this particular icacls fix may not be universal. It also suggests that Anthropic's installer or first-run setup process may not yet robustly handle permission provisioning for the vm_bundles directory across all Windows 10/11 configurations, leaving early adopters to file bug reports and share manual workarounds. As AI companies increasingly push toward local, sandboxed agentic execution as a way to balance capability with safety, these kinds of OS-level integration challenges are likely to become a recurring theme, underscoring the gap between cloud-native AI development and the messier realities of cross-platform desktop deployment.
Read original article →