If you installed the Claude desktop app on Windows, you may have spotted cowork-svc.exe in Task Manager, running even though you never opened anything called Cowork. It's not malware. It's the background service that runs the virtual machine behind Claude Cowork, Anthropic's agent mode in the desktop app.
Cowork does its work inside a separate Linux machine so Claude's commands don't run directly on your PC. Anthropic's Cowork architecture page says shell commands and any code Claude writes run inside a dedicated Linux VM, isolated from your system by the hypervisor, which on Windows is Hyper-V. cowork-svc.exe is the program that starts and manages that VM. In the Services list it's registered as CoworkVMService, but its display name is just "Claude," which is why Windows event logs blame "Claude" when it stops.
It runs at boot because the app package tells it to. A GitHub issue filed in May shows the package manifest registers the service with an automatic startup type under the LocalSystem account, so it starts on every boot whether or not you use Cowork. That issue asks Anthropic for an off switch and was still open with no reply from Anthropic as of October 21. The same reporter found that sc.exe config CoworkVMService start= disabled fails with "Access is denied," even from an administrator PowerShell, because Windows protects services that ship inside app packages.
To check that yours is the real thing, open an administrator PowerShell and run sc.exe qc CoworkVMService. You should see the type WIN32_PACKAGED_PROCESS, start type AUTO_START, and LocalSystem as the account. You can also right-click cowork-svc.exe in Task Manager, choose Open file location, and check the Digital Signatures tab in the file's properties. A genuine copy lives inside Claude's package folder under C:\Program Files\WindowsApps and is signed by Anthropic, PBC. The service process itself is small. On a current install it used around 35 MB of memory.
When cowork-svc.exe breaks
Most people only learn this service exists when it fails. The usual message is "Failed to start Claude's workspace / VM service not running. The service failed to start," or tasks reporting "workspace unavailable." The known causes, most common first:
The service crashed and didn't come back. One open bug from September describes the service stopping unexpectedly, logged as Service Control Manager event 7034, and staying down until a reboot because it doesn't set up its own recovery actions. Users in that thread and in an earlier report restart it with Start-Service CoworkVMService in an administrator PowerShell, wait about half a minute for the VM to boot, then reopen Claude.
Windows virtualization isn't turned on. Anthropic's Windows deployment article says Cowork needs the Virtual Machine Platform feature. An error like "Missing HCS services: HNS, vmcompute, vfpext" means it isn't registered. The fix Anthropic gives is Enable-WindowsOptionalFeature -Online -FeatureName VirtualMachinePlatform -All in an administrator PowerShell, followed by a reboot.
Fast Startup left things half loaded. The same article tells you to use Restart, not Shut down and power on, because Windows Fast Startup can leave the virtualization services uninitialized after a shutdown. This one catches a lot of laptops.
It was installed without admin rights. Windows only registers the service when Claude is installed with administrator privileges. Without them, Claude still installs, but Cowork isn't available.
Older failures, like the service crashing on every start with exit code 1066, were fixed in earlier releases, so update the app before trying anything else.
If you never use Cowork and want the service gone, there's no supported way to turn it off yet. One user in the GitHub thread reported that adding "secureVmFeaturesEnabled": false to the Preferences section of claude_desktop_config.json stopped it. That's a community workaround, not anything Anthropic documents, so back up the file first and expect an app update to undo it.
If the whole app is crashing, not just Cowork, our post on every way the Claude desktop app crashes on Windows covers the rest.
Sources
Claude Help Center: Claude Cowork architecture overview - Cowork running shell commands and code in a dedicated Linux VM isolated by Hyper-V on Windows, and the workspace unavailable state.
Claude Help Center: Deploy Claude Desktop for Windows - The background service that runs Cowork's VM, registration only with administrator privileges, the Virtual Machine Platform requirement and command, the missing HCS services error, and the Fast Startup restart advice.
GitHub issue #57371 - The service starting automatically at boot under LocalSystem, the package manifest entry, sc.exe config returning access denied, and the user-reported secureVmFeaturesEnabled workaround.
GitHub issue #92527 - The service terminating with event 7034 and staying down until reboot, and restarting the service as a full recovery.
GitHub issue #36590 - The failed-to-start error text and the Start-Service workaround.
GitHub issue #38396 - The exit code 1066 crash on startup, closed as completed.
