Darktrace researchers turned Claude Code into a remote-controlled implant in a lab, Help Net Security reports. Every command and result went through api.anthropic.com, so it looked like a coding agent doing normal work.
- The catch: The attacker first needs a compromised developer machine and the user’s Claude credentials. It’s not a Claude platform vulnerability, and it hasn’t been seen in the wild.
- How: Memory stores, built for Claude Managed Agents, can be added to any Console workspace through the API. Darktrace used three files as heartbeat, job inbox and outbox. A systemd service kept relaunching Claude Code with
--dangerously-skip-permissions. - Result: In nine plain-English jobs, the agent mapped a test AD network, found a password on an FTP share, sprayed it, found the matching account, and sent a 1 GB file out through the Files API.
What to do
Treat your AI API keys like cloud admin keys. Don’t leave them in plaintext on dev boxes, scope and rotate them, and watch your workspace for memory stores or files you didn’t create. Alert on long-running agent processes started by services rather than people.
My take
When “the coding agent is busy” counts as normal traffic, egress filtering won’t catch this. Put spend alerts and audit logs on your AI accounts before you need them.
God Bless, and Happy hacking!
