Follow us on Google News
Cybersecurity researchers have demonstrated how stolen API credentials could allow attackers to turn Anthropic’s Claude Code into a remotely controlled tool for stealing sensitive corporate information.
In a controlled security experiment, researchers used the AI coding assistant to extract a 1 GB file through legitimate Claude services, raising concerns about the misuse of AI agents inside business networks.
https://the420.in/fcrf-certified-chief-ai-officer-second-cohort-november-2026/
The experiment showed that attackers could exploit existing AI capabilities without discovering a new software vulnerability or bypassing the platform’s security protections.
How Can Hackers Take Control of Claude Code?
The attack requires criminals to first compromise a developer’s computer and obtain valid Claude credentials. In the experiment, researchers assumed that the credentials were accessible on a machine where the AI coding tool had previously been used.
Once access was established, the researchers demonstrated how Claude’s memory stores could serve as a communication channel between an outside operator and the AI agent.
Memory stores are collections of text files attached to a Claude Console workspace. They allow AI agents to retain information between sessions. Researchers found that these stores could be accessed through the API, including in workspaces not using Claude Managed Agents.
The experiment involved three files that allowed the agent to receive instructions, report its activity and retrieve additional tasks. Because the instructions were written in ordinary English, the operator could assign objectives while the AI system handled the necessary technical operations.
The researchers stressed that the technique had been demonstrated in a laboratory environment and had not been observed in real-world attacks.
What Information Could the AI Agent Steal?
The controlled experiment took place inside a simulated corporate network using Microsoft’s Active Directory environment.
After gaining access to a Linux computer running Claude Code, the researchers demonstrated nine successive tasks performed by the AI agent. The system examined the local network, collected employee account information and accessed an anonymous FTP share containing usernames and password details.
Using the available information, the agent generated 190 potential usernames, identified the password associated with a domain administrator account and located accessible network resources.
It subsequently downloaded a 1 GB file and transferred the information through Anthropic’s Files API in three separate portions. The researchers confirmed that all employee names, credentials and network details used in the demonstration were fictitious.
The experiment illustrated how a compromised AI agent with sufficient permissions could perform activities normally associated with an intruder operating inside a corporate network.
Why Could Such Attacks Be Difficult to Detect?
One concerning finding was that the malicious activity travelled through legitimate Claude infrastructure. The agent communicated with the same API endpoint it ordinarily uses for coding and other authorised tasks. Consequently, its network activity could resemble normal communication between a developer’s AI tool and its service provider.
Researchers explained that this approach does not require an unusual external destination, malicious software or a newly discovered vulnerability.
The technique was tested specifically with Claude’s memory functionality and has not been reproduced on other AI platforms.
Security experts advised organisations to protect API credentials, restrict unnecessary permissions and avoid exposing authentication information through development environments.
They also recommended monitoring unusual agent behaviour, including unexpected command execution, excessive API activity and large transfers of information.
The findings demonstrate that legitimate AI capabilities can create security risks when attackers obtain valid credentials. Protecting those credentials and examining how AI agents behave within corporate networks remain essential safeguards as businesses increasingly adopt autonomous AI tools.
