Darktrace says stolen Claude API keys can steer Claude Code as implant

What happened

According to Help Net Security, Darktrace researchers say they turned Claude Code into a remote-controlled implant in a lab test. Per the same report, they steered the agent through the memory stores feature of Anthropic’s Claude platform and pulled a 1 GB file out through the Claude Files API. This is Darktrace’s own research as relayed by one outlet. No independent verification is cited.

Help Net Security says that all job and result traffic went through api.anthropic.com, the endpoint the agent already uses for inference, so it looked like a coding agent doing its job.

Preconditions and limits, as reported by Help Net Security:

• An attacker must first compromise a developer’s machine and obtain the user’s Claude credentials. In Darktrace’s scenario these were on the device where the user’s tooling had left them.
• The technique does not rely on a vulnerability in the Claude platform, and Darktrace says it has not seen it used in the wild.
• Darktrace shared the findings with Anthropic before publication as a courtesy, with no formal disclosure process because, per Darktrace’s Tim Bazalgette, there is no vulnerability to disclose. Any response from Anthropic is not confirmed.

How the test worked, per the same report:

• Memory stores are collections of text files attached to a Claude Console workspace. A store can be added through the API whether or not the organization uses Managed Agents.
• The researchers created a store with three files. Each new Claude Code process wrote a check-in to a heartbeat file, read a job from an input file, and posted results to an output file.
• The test ran on a simulated Active Directory network. A small shell payload found Claude Code on a Linux machine, collected the credentials, and set up a systemd service that kept launching Claude Code processes with the --dangerously-skip-permissions flag, which turns off tool-use confirmation prompts.
• Nine jobs were sent. The agent mapped the network, took names and a password from an anonymous FTP share, generated 190 candidate usernames, and sprayed the password at the domain controller. It then listed SMB shares, downloaded a 1 GB file, split it into three pieces, and uploaded them to the Files API.
• The names and credentials Darktrace published are fictitious.

Am I affected?

Not confirmed for any real environment. Darktrace says it has not seen the technique in the wild, and it needs a prior compromise of a developer machine plus the user’s Claude credentials, according to Help Net Security.

Exposure is most relevant if Claude Code runs on machines where API keys are stored in shell history, dotfiles or environment variables. Bazalgette says a standard API key reaches memory stores while OAuth credentials do not. He also says an OAuth session could be hijacked, but that this is harder to pull off.

Bazalgette says the memory stores feature is specific to the Claude platform and that Darktrace has not reproduced the technique elsewhere. He adds that the file-upload endpoint used for exfiltration has an equivalent at OpenAI.

What to do now

The steps below follow the advice Darktrace’s Tim Bazalgette gave to Help Net Security.

1. Use OAuth or another form of identity federation wherever the platform allows it.
2. Where keys are unavoidable, make them as short-lived as possible, keep their scope narrow, and store them securely.
3. Avoid exposing keys where they are not needed, such as shell history, dotfiles and environment variables.
4. Treat an AI platform key as seriously as a production credential.
5. Monitor agent behaviour. Darktrace suggests correlating which agent harness processes launch with the network traffic they generate, and comparing both against a baseline. Signs to look for are a Claude Code process running tool calls with odd command-line arguments, or moving data to and from the API in a ratio unlike its usual traffic.

No patch or fixed version is reported, since no vulnerability is claimed.

Sources

• Help Net Security: Stolen Claude API keys can turn Claude Code into a remote-controlled implant