Security firm Darktrace says it turned Claude Code into a remote-controlled implant inside a test network, using only features that Anthropic's Claude platform already offers. In a blog post published November 12, researchers from Darktrace Signal Labs describe how an attacker who already has a foothold on a developer's machine, and the user's Claude credentials, can send plain-English jobs to Claude Code and get results back through Anthropic's own API.
The work was done in a lab. Darktrace says the technique "does not rely on a vulnerability in the Claude platform" and that it has not seen it used in the wild. The point of the research is narrower and still useful: once an AI agent is trusted inside a company, its normal channels can carry an attacker's traffic.
What Darktrace built
The channel is the memory stores feature of the Claude platform. Anthropic's docs describe a memory store as "a workspace-scoped collection of text documents optimized for Claude," built so agents on Claude Managed Agents can carry information from one session to the next.
Darktrace found that a memory store "can, however, be added to a Claude Console workspace regardless of whether the Claude Managed Agents service is being used." With stolen API credentials, the researchers added a store with three files to a workspace the victim user belonged to:
- Heartbeat file. Each new Claude Code process wrote a time-stamped check-in here.
- Input file. The operator wrote the next job here, in plain English.
- Output file. The agent posted the results of each job here.
The operator read the output file, then overwrote the input file with the next job. Because the agent reads and writes these files through the Claude API, which is the same endpoint it calls for inference, the traffic looked like a coding agent doing normal work. Help Net Security summed it up: "every job and every result traveled through api.anthropic.com."
The nine-job test run
The simulation ran on a test network that models a corporate Active Directory setup, with a Linux machine running Claude Code, an SMB server and a domain controller.
According to Darktrace, a small first payload looked for a Claude Code install, collected the user's Claude Console API and OAuth credentials, and sent them to a staging server. The script then used systemd-run to create a service that kept starting new Claude Code processes. Darktrace says those processes invoked a Claude Sonnet 4.5 model in non-interactive mode. Help Net Security reports that they ran with the --dangerously-skip-permissions flag, which Anthropic's CLI reference describes as "Skip permission prompts."
From there, the first script was no longer needed. The operator sent nine jobs through the memory store, one Claude Code process per job. Darktrace's write-up lists what the agent did:
- Mapped the local network and found a server with open FTP, SMB and SSH ports.
- Ran a targeted nmap scan of that server.
- Pulled employee names and a password from an anonymous FTP share.
- Generated a list of 190 candidate usernames.
- Sprayed the password at the domain controller and found the matching account.
- Listed SMB shares with that account, then the contents of one share, which held a 1 GB file.
- Downloaded the file, split it into three pieces and uploaded them to the Claude Files API.
Darktrace says the file was "exfiltrated to the C2 operator via the Claude Files API." Darktrace says all names and credentials in its write-up are fictitious and no customer systems were used.
Why it matters
Attackers have long "lived off the land," abusing tools that are already installed so they do not set off alarms with new software. Darktrace argues AI agents are the next such tool. The agent already has access, its API traffic is expected, and the operator does not need to write commands. In Darktrace's words, the operator "can simply issue objectives to the agent in the form of general natural language instructions."
Tim Bazalgette, Darktrace's Chief AI Officer, told Help Net Security the team tested only Claude: "The memory stores feature is specific to the Claude platform. The file-upload endpoint we used for exfiltration has an equivalent at OpenAI." He said exposure depends on whether a provider's API offers text storage alongside inference, how tightly credentials are scoped, and whether customers can see writes to that store. "None of those are flaws," he said. "They're trade-offs between capability and exposure."
He also pointed to a scope difference in this case: "here a standard API key reaches memory stores, while OAuth credentials don't." Darktrace shared the findings with Anthropic before publication, "as a courtesy," Bazalgette said, with "no formal disclosure process, because there's no vulnerability to disclose." Darktrace's post notes that Anthropic "has not endorsed this research."
It is not Darktrace's first look at coding agents. In September, the same lab showed that faked conversation history stored on disk could steer Claude Code, OpenAI Codex, AWS Kiro-CLI and Pi.
What teams can do
Bazalgette's advice to Help Net Security starts with the keys: "use OAuth or some form of identity federation wherever the platform allows it." Where that is not possible, he said to keep keys short-lived and narrowly scoped, store them securely, and keep them out of "shell history, dotfiles, environment variables and the like." His summary: "Treat an AI platform key as seriously as a production credential."
Anthropic's own Files API docs make a related point: "Any API key with access to a workspace can access any files uploaded to that workspace." The same docs suggest keeping files that must stay separate in their own workspace, used only with keys scoped to it.
For detection, Darktrace says it is normal for an agent process to run tool calls and contact its AI provider's API. What is not normal is that process running tool calls "with certain command-line arguments" or moving data to and from the API at unusual ratios. For how Anthropic itself suggests limiting what Claude Code may run, see our post on Claude Code auto mode and deny rules.
For more on how Anthropic's agent memory is meant to work, see our explainer on Anthropic's agent memory research. For other recent Claude security news, see Cisco and IBM adding Claude Mythos to security products.
Sources
- Darktrace: Living off the AI: How Claude Memory Stores Enable Covert C2 Channels
- Help Net Security: Stolen Claude API keys can turn Claude Code into a remote-controlled implant
- Darktrace: Agent Hijacks: How Conversation History Poisoning Can Turn AI Agents Into Attackers
- Claude Docs: Using agent memory
- Claude Docs: Files API
- Claude Code Docs: CLI reference
