Darktrace turns Claude Code into a remote-controlled implant in a lab test using stolen API keys
Researchers steered the coding agent through Claude memory stores and pulled a 1 GB file out via the Files API, with all traffic going to api.anthropic.com; it needs a compromised developer machine first, exploits no platform flaw and has not been seen in the wild.
Why it matters
The test shows how an agent's normal channel to its provider can double as a hidden command line: jobs and results travelled through the same endpoint Claude Code uses for inference, so the traffic looked like ordinary coding work. Darktrace ran nine jobs on a simulated corporate network, including password spraying a domain controller. It says exposure depends on whether a provider offers text storage beside inference, how tightly keys are scoped, and whether customers can see writes to that store. Watch for a response from Anthropic and for tests on other platforms.
Key facts
- Researcher: Darktrace
- 1 GB file exfiltrated via the Files API
- Nine jobs sent through a Claude memory store
- Requires stolen Claude credentials on a compromised machine
- No platform vulnerability used
- Not seen in the wild