Stolen Claude API Keys Transform AI Coder into Remote-Controlled Implant
Researchers demonstrated how compromised Anthropic Claude API keys can weaponize the Claude Code AI agent into a data exfiltration and command execution tool, routing malicious activity through legitimate endpoints.
Security researchers at Darktrace have successfully transformed Anthropic's Claude Code AI agent into a sophisticated remote-controlled implant within a controlled laboratory environment. The technique leverages the platform's memory stores feature and Claude Files API to exfiltrate data and execute arbitrary commands, with all malicious traffic masked as legitimate agent activity by routing through the standard api.anthropic.com endpoint.
The attack vector requires an initial compromise of a developer's machine to obtain Claude API credentials, which were found to be accessible on the device in Darktrace's scenario. Crucially, this method does not exploit any vulnerabilities within the Claude platform itself, and Anthropic has not observed this technique being used in the wild. The exploit hinges on the misuse of features designed for agent functionality, rather than a flaw in the AI's core programming.
Memory stores, collections of text files attached to a Claude Console workspace, are intended to allow agents on Anthropic’s Claude Managed Agents service to retain context between sessions. Darktrace discovered that these stores can be attached to a workspace via the API, irrespective of whether an organization actively uses Managed Agents. The researchers established a store containing three files: a heartbeat file for agent check-ins, an input file for job instructions, and an output file for results.
Once configured, each Claude Code process would write a status update to the heartbeat file, read a new job from the input file, execute it, and then post the results to the output file. An operator could then read the output and provide the next job. Because the jobs are described in plain English, the operator can issue high-level objectives, allowing the AI model to determine the necessary commands.
In a simulated corporate Active Directory network, a small shell payload on a Linux machine was used to find Claude Code. This payload then collected credentials and established a systemd service to repeatedly launch Claude Code processes with the --dangerously-skip-permissions flag, which bypasses tool-use confirmation prompts. The operator then issued nine jobs through the memory store.
The agent successfully mapped the local network, extracted employee names and a password from an anonymous FTP share, generated 190 potential usernames, and identified a valid domain account by spraying the password at the domain controller. It then listed SMB shares accessible with that account and downloaded a 1 GB file, which was subsequently split into three parts and uploaded to the Claude Files API, effectively exfiltrating the data through Anthropic's servers. The names and credentials used in Darktrace's demonstration were fictitious.
Darktrace's Chief AI Officer, Tim Bazalgette, noted that while the memory stores feature is specific to Claude, similar file-upload endpoints exist at other providers like OpenAI. The key factor for such attacks is the availability of text storage functionality alongside inference capabilities via the API. He emphasized that credential scoping and visibility into store writes are critical considerations for security, advising organizations to treat AI platform keys with the same caution as production credentials.
Darktrace recommends securing API keys by using OAuth or identity federation where possible, and for API keys that cannot be federated, employing short lifespans, narrow scopes, secure storage, and avoiding exposure in insecure locations like shell history or environment variables. Detection strategies involve correlating agent process behavior with network traffic, looking for anomalies in command-line arguments or data transfer ratios to the API that deviate from normal operational patterns. As Bazalgette stated, "Approved is not the same as safe, and only behaviour tells you the difference."