Hackers Can Manipulate Claude AI APIs with Indirect Prompts to Steal User Data

A security researcher disclosed that Anthropic’s Claude AI system can be exploited through indirect prompts to exfiltrate user data via its built‑in File API. The attack relies on Claude’s Code Interpreter and API features, which researchers demonstrated could be manipulated to send sensitive information from a victim’s workspace to an attacker‑controlled account.

By injecting an indirect prompt, an attacker could cause Claude to write data to a local file within its sandbox and then use the File API to upload that file, with the code inserting the attacker’s API key so the upload occurs in the attacker’s Anthropic account. Tests showed an ability to steal up to 30 MB per file upload, though initial attempts encountered some detection when visible API keys were present.

The discovery was disclosed to Anthropic via HackerOne on 25 October 2025, and Anthropic later acknowledged on 30 October that data exfiltration attacks of this nature are within the scope of responsible disclosure. The incident underscores the need for tighter monitoring and stronger egress controls as AI platforms gain more networked capabilities.