Claude Vulnerabilities Allow Data Exfiltration and Malicious Redirect Attacks

Security researchers have identified a critical vulnerability within Anthropic's Claude.ai platform. This vulnerability, named "Claudy Day," allows attackers to extract sensitive user data via prompt manipulation and malicious redirects.

The exploit operates entirely within a standard Claude session without requiring external integrations or specialized tools. Anthropic has addressed the prompt injection flaw following responsible disclosure, and further fixes are in progress.

Technical Details of the Vulnerability

Researchers mapped out three distinct flaws that constitute the attack pipeline:

Invisible Prompt Injection: Malicious HTML tags are embedded in pre-filled Claude.ai URL parameters, enabling attackers to execute hidden commands when the user interacts with the prompt. Data Exfiltration: An attacker-controlled API key embedded within the hidden prompt forces Claude to search the user's chat history and upload sensitive data directly to the attacker's Anthropic Files API account. Open Redirect: Unvalidated redirects on the main claude.com domain are exploited via Google Ads, tricking users into clicking malicious links that appear to be legitimate search results.

This exploit combines these issues to bypass user trust and security controls. It begins by exploiting the open redirect vulnerability on the main Anthropic domain. Using Google Ads, threat actors display what appear to be legitimate search results. When a victim clicks the link, they are redirected to a specialized injection URL without warning.

The malicious URL uses Claude's feature for pre-filling chat prompts. The hidden HTML instructions force the AI to scan previous conversation logs, summarizing sensitive information like financial plans, medical concerns, and corporate secrets. The AI writes this data to a file and uploads it to an attacker-controlled account, evading standard outbound network restrictions.

The attack extracts historical chat data, but the potential damage increases when users connect Claude to external enterprise applications. If Model Context Protocol (MCP) servers, third-party APIs, or corporate files are linked, the hidden prompt gains immediate access to these resources. The AI could silently read secure files or interact with internal services before the victim notices the attack.

Securing AI environments requires strict oversight of how agents interact with corporate data and external services. Organizations should audit their AI integrations, disable unnecessary MCP servers, and restrict API access to limit the impact of a compromised prompt.

Security teams should treat AI agents with the same scrutiny as human users or service accounts, implementing strict access controls, intent analysis, and continuous monitoring. Educating employees about the risks of shared links and pre-filled AI prompts is also crucial. As AI tools become more autonomous, proactive identity and access management is essential to prevent compromises.

Based on reporting by GBHackers.