Stolen Claude API keys enable remote-controlled implant for data exfiltration via Anthropic's Claude platform
Darktrace researchers demonstrated how stolen API keys for Anthropic's Claude platform can be used to turn Claude Code into a remote-controlled implant for data exfiltration. By compromising a developer's machine and obtaining the user's Claude credentials, the attacker used the platform's memory stores feature and Files API to orchestrate command and control operations, including mapping a network, harvesting credentials, and exfiltrating a 1 GB file. This technique does not exploit a bug in Claude but leverages legitimate API features meant for memory persistence and file handling. While tested only on Claude, similar risks could exist on other AI platforms with analogous text storage and file upload functions. The attack underlines the need for securing API keys as sensitive credentials and monitoring agent behavior for unusual patterns despite legitimate API usage.
Linha do tempo
-
Stolen Claude API keys enable remote-controlled implant for data exfiltration via Anthropic's Claude platform
ler a análise desta fonte ocultar
Darktrace researchers demonstrated how stolen API keys for Anthropic's Claude platform can be used to turn Claude Code into a remote-controlled implant for data exfiltration. By compromising a developer's machine and obtaining the user's Claude credentials, the attacker used the platform's memory stores feature and Files API to orchestrate command and control operations, including mapping a network, harvesting credentials, and exfiltrating a 1 GB file. This technique does not exploit a bug in Claude but leverages legitimate API features meant for memory persistence and file handling. While tested only on Claude, similar risks could exist on other AI platforms with analogous text storage and file upload functions. The attack underlines the need for securing API keys as sensitive credentials and monitoring agent behavior for unusual patterns despite legitimate API usage.