I have a similar problem also with a whonix-based AppVM. But I haven’t had the chance to look more into it yet. From the security perspectives, the possibility of a bug like this does sound some alarms.
Maybe worth checking on the whonix forum for similar problems?
(@abc I’ve made the title a bit more specific. Feel free to edit it back if you feel it doesn’t apply)