Claude AI APIs Can Be Abused for Data Exfiltration

SecurityWeek reports that attackers can use indirect prompt injections to trick Claude into exfiltrating data the model’s users have access to, a claim explained by security researcher Johann Rehberger of Embrace The Red. The attack abuses Claude’s Files APIs and requires the model to have network access, a feature enabled on some plans, and involves reading user data, saving it to the Code Interpreter sandbox, and then triggering the Anthropic API with the attacker’s key to send the data to the attacker’s account.

Rehberger notes that, with this technique, an adversary can exfiltrate up to 30MB at once according to the file API documentation, and multiple files could be uploaded. The exploit starts when a user opens a malicious document for analysis, after which the code hijacks the model to harvest data, store it in the sandbox, and call the Anthropic File API to transfer it to the attacker.

The researcher also explains that the attack could exfiltrate a user’s chat conversations, which Claude stores using its memories feature, with the attacker able to view the exfiltrated file in their console. The disclosure was made to Anthropic via HackerOne on 25 October, and SecurityWeek notes Anthropic’s documentation warns of the risks of Claude having network access and external files or websites enabling such leaks.