Darktrace controlled Claude Code in a test with one Claude key

Darktrace, a security company, controlled Claude Code in a lab test. Claude Code is a coding agent from Anthropic. The researchers sent 9 tasks through the memory store function of the Claude platform. They moved 1 GB of data out through the Claude Files API. All traffic went to an Anthropic address that the agent uses for its usual work.

How it works

Memory stores are text items that let agents keep data between sessions. Each new agent process wrote a check in, read a task, did it, and wrote the result. The operator tells the model the task in text, and the model finds the commands.

The test result

The test network was set up as a company network. The agent found a password on a file server that has no login. It tried 190 usernames and found the account. Then it got 1 GB of data and sent it in 3 parts to the Files API.

What is not known

The attacker must first control the computer of a developer and get the credentials. Darktrace reports no vulnerability in the platform and no use of this attack by other people. Its chief AI officer tells that OpenAI has an equivalent upload endpoint.

Insight: A Claude key can give an attacker a worker

Apiiro found 1,122 copies of one Claude Code settings file. A person can see them, and they hold secrets in text. Darktrace shows that a Claude key can control an agent. It reads as a sign that the key is the first item that an attacker must get. The path is approved, and no monitor shows a problem. Look at the data that your agents write to storage.