Stolen Claude keys can turn Claude Code into an implant
Original title: Stolen Claude API keys can turn Claude Code into a remote-controlled implant
In a lab test, Darktrace exfiltrated a 1 GB file through Anthropic APIs and has not seen the method in the wild.
Darktrace researchers showed in a lab that stolen Claude credentials can turn Claude Code into a remote-controlled implant using Claude memory stores and the Files API. Jobs and results traveled through api.anthropic.com, the agent's normal inference endpoint. The test required a prior compromise of a developer machine and does not rely on a Claude vulnerability. Anthropic was told before publication; Darktrace said there was nothing to disclose as a vulnerability.
Unconfirmed: Darktrace tested only Claude and has not reproduced the pattern on other platforms.
- A memory store can be added by API even without Managed Agents.
- A systemd service relaunched Claude Code with confirmation prompts disabled.
- Nine jobs included password spraying and upload of a split 1 GB file.
- A standard API key can reach memory stores, while OAuth credentials cannot.
- Published names and credentials from the Active Directory test are fictitious.
Impact: Remote tasking of Claude Code and file exfiltration through Anthropic APIs
- 1.Prefer OAuth or identity federation and keep API keys short-lived and narrowly scoped.
- 2.Correlate Claude Code process launches with unusual traffic to Anthropic APIs.
- ATT&CK
- T1552.001 Credentials In FilesT1543.002 Systemd ServiceT1110.003 Password SprayingT1071.001 Web ProtocolsT1041 Exfiltration Over C2 Channel
- Vendors
- Anthropic
- Products
- Claude Code
- Organizations
- Darktrace
- AI models
- Claude
From the original article
4 min read at helpnetsecurity.com
Darktrace researchers turned Claude Code into a remote-controlled implant in a lab test, steering the coding agent through the memory stores feature of Anthropic’s Claude platform and pulling a 1 GB file out through the Claude Files API. Once the agent was set up, every job and every result traveled through api. anthropic.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.