Claude Vulnerabilities Allow Data Exfiltration and User Redirection to Malicious Sites
Three vulnerabilities were identified in Claude.ai, an AI assistant developed by Anthropic, which could allow unauthorized data exfiltration and user redirection to malicious websites without requiring additional tools or configurations.
Three vulnerabilities were identified in Claude.ai, an AI assistant developed by Anthropic, which could allow unauthorized data exfiltration and user redirection to malicious websites without requiring additional tools or configurations.
The vulnerabilities, reported under the name Claudy Day through a Responsible Disclosure Program, have been addressed with a patch for the primary issue.
Technical Details of the Vulnerabilities
Invisible Prompt Injection via URL Parameters
Claude.ai supports pre-filled prompts via URL parameters ( claude.ai/new?q=... ). Researchers discovered that certain HTML tags can be invisibly embedded in these parameters, allowing attackers to include hidden commands within a seemingly normal prompt.
Data Exfiltration via the Anthropic Files API
The system's sandbox permits traffic to api.anthropic.com . By using an attacker-controlled API key, Claude can be instructed to compile and upload sensitive conversation data to the attacker’s Anthropic account through the Files API.
The vulnerabilities, reported under the name Claudy Day through a Responsible Disclosure Program, have been addressed with a patch for the primary issue.
URLs in the format claude.com/redirect/<target> can redirect users to third-party domains without validation. This can be exploited using Google Ads to redirect users to malicious sites.
In default Claude.ai sessions, conversation history may contain sensitive information such as business strategies, financial plans, or personal details. Attackers can profile users or extract specific sensitive content through injection payloads.
Organizations using Claude.ai should audit agent integrations and disable unnecessary permissions to reduce potential risks. Educating users about the risks of pre-filled prompts and shared links is essential.
From a governance perspective, AI agents with credential access should be managed with the same security measures as human users, including intent analysis and access controls.
The prompt injection vulnerability has been resolved, and Anthropic is addressing the remaining issues. Organizations should ensure their AI platforms are secured against such vulnerabilities.
Based on reporting by Cyber Security News.