Claude AI vulnerability chain enables silent data exfiltration
Security researchers discovered a chain of three vulnerabilities in Claude.ai that enable attackers to silently extract sensitive user conversation history through prompt injection, open redirects, and API flaws. Anthropic patched the prompt injection flaw and is addressing remaining infrastructure issues.
What happened
Security researchers at Oasis Security identified an exploit chain affecting Claude.ai that chains three vulnerabilities: invisible prompt injection via URL parameters, an open redirect on claude.com, and data exfiltration via the Anthropic Files API.
When a victim clicks a malicious link and submits a prompt, hidden instructions embedded in URL parameters are processed by the system. The hidden prompts can include attacker-controlled API keys that allow the system to package sensitive user conversation history and upload it to an attacker-controlled Anthropic account via the Files API.
Security researcher Johann Rehberger disclosed that Claude's responses can include markdown image tags that reference external URLs, which browsers automatically fetch. When Claude renders a response containing an image tag pointing to an attacker-controlled server, the browser sends the request and the URL can carry stolen data encoded as parameters without visible indication to the user.
Reported impact
In a standard user session, the AI agent can access conversation history and memory, which may include sensitive user information. If a user enables enterprise integrations, specialized tools, or Model Context Protocol servers, the potential blast radius expands exponentially.
Threat actors can command the compromised agent to read internal files, interact with connected application programming interfaces, and transmit messages autonomously.
Index analysis
The exploit chain combines prompt injection, which prevents Claude from reliably distinguishing between user instructions and instructions embedded in data, with markdown rendering and context access vulnerabilities.
The attack enables silent data exfiltration without pop-ups, warnings, or visible indication that something has gone wrong, exposing fundamental security gaps across the AI industry.
Governance controls
Anthropic has fixed the prompt injection vulnerability and is mitigating the remaining structural issues. Organizations must proactively audit their connected agent integrations.
Organizations should inventory all AI agents and their integrations, gain visibility into AI agent usage, educate users that shared links and pre-filled prompts can contain hidden instructions, and establish governance for AI agent identities.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.