[BUG] Cowork VM creates new OAuth token on every session (token accumulation)

[variuse]

Summary

The Claude Cowork desktop app mints a new OAuth token every time a Cowork session starts, causing unbounded token accumulation in Settings -> Claude Code -> Authorization Tokens. After ~5 weeks of normal use: 40+ tokens, no bulk-revoke, broken UI.

Root Cause (confirmed via filesystem inspection)

Two separate Claude Code binaries exist on disk:

• ~/Library/Application Support/Claude/claude-code/2.1.49/claude (regular CLI)
• ~/Library/Application Support/Claude/claude-code-vm/2.1.49/claude (Cowork VM binary)

The claude-code-vm binary runs inside an ephemeral Linux sandbox. The VM home has no .claude/ directory and no access to the macOS Keychain. On every session start, it finds no credentials, re-authenticates, and mints a new token. Nothing in local config causes this - it is a product design gap.

Secondary Issue

The token management UI at claude.ai/settings/claude-code does not refresh after revocation and offers no bulk-revoke or "keep only current" option. With 40+ tokens, manual cleanup is effectively unusable.

Expected Behavior

The Cowork VM should either:

• Receive/reuse the authenticated token from the desktop app on session start, or
• Persist its credential to the mounted user directory so it survives VM resets

Environment

• macOS
• Claude Desktop App v2.1.49
• Both claude-code and claude-code-vm binaries present at v2.1.49
• Apple subscription plan

Related Issues

• Claude Desktop App: Cowork tab stuck on 'Sending request' - UUID validation error #20016 (Cowork tab stuck on sending request)
• [BUG] Claude Cowork stuck on 'sending request'  #18474 (Cowork stuck on sending request)
• Frequent re-authentication required with multiple concurrent Claude Code sessions (OAuth refresh token race condition) #24317 (OAuth refresh race condition with multiple sessions)

[github-actions]

Found 3 possible duplicate issues:

1. [Bug] Claude Code VM binary is Linux ELF instead of macOS Mach-O on M2 #27532
2. [BUG] claude-code-vm downloads Linux ARM binary on macOS, breaking Claude Code in Desktop #26945
3. [BUG] Cowork Windows: Multiple wvm- temp folders accumulate in AppData\Local\Temp and are never cleaned up #28141

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[variuse]

Don't see any relation with the 3 issues listed (maybe with the 3. ... but here I am not able to confirm relation)

[JAMcoder111111]

Experiencing the same token accumulation issue on Linux (CLI, not Cowork). Each claude /login creates a new token, and claude /logout only clears local credentials without revoking the server-side token.

Would love to see:

/logout revoke the token server-side, not just locally
A bulk-revoke option in the settings UI
Re-authentication replacing the existing token instead of creating a new one

[github-actions]

Closing for now — inactive for too long. Please open a new issue if this is still relevant.

[github-actions]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.