Stolen Claude API keys can turn coding agents into remote-controlled implants

The remote control mechanism

Researchers at Darktrace recently conducted a lab test showing how stolen Claude API keys can be used to turn Claude Code into a remote-controlled implant. The attack does not rely on a software vulnerability or a bypass of the AI's safety guardrails. Instead, it leverages the platform's existing features to move data and execute commands.

The researchers focused on the memory stores feature of Anthropic’s Claude platform. These stores are designed as collections of text files that help agents remember information between different sessions. However, the team found that these stores can be added to a workspace through the API even if a company is not using the official Managed Agents service.

By creating a store with specific files, the researchers established a system for remote interaction. They set up a heartbeat file to track active processes, an input file for new jobs, and an output file for results. This allowed an operator to send plain English instructions that the AI model would then translate into specific technical commands.

Simulating a corporate breach

To test the concept, the team simulated a corporate Active Directory network. They began by compromising a developer's machine to steal Claude credentials that were left on the device. Once they had access, they installed a small shell payload to launch Claude Code processes on a Linux machine.

The attackers used a specific flag to skip permission prompts, which allows the agent to perform actions without asking for user confirmation. They then sent nine jobs through the memory store to the hijacked agent. The agent successfully mapped the local network, found employee names, and identified a domain account by spraying a password at the domain controller.

After gaining access to the account, the agent listed shared folders and downloaded a 1 GB file. The researchers then split this file into three pieces and uploaded them to the Claude Files API. Because the traffic traveled to the standard Anthropic endpoint, it appeared to be normal coding activity rather than a data breach.

Trade-offs in AI capabilities

The findings highlight a significant trade-off between the utility of AI platforms and their security profile. Tim Bazalgette, Chief AI Officer at Darktrace, noted that the memory stores feature is specific to Claude, though OpenAI has an equivalent file-upload endpoint. The core issue is whether a provider's API exposes text storage alongside inference capabilities.

The research suggests that the level of exposure depends on how a company manages its credentials. In this test, a standard API key provided access to the memory stores, while OAuth credentials might offer more restricted permissions. These are not considered flaws by the researchers but rather inherent trade-offs that organizations must evaluate when deploying agents.

Darktrace shared these findings with Anthropic as a courtesy before publication. Because the technique uses legitimate features as intended by the developers, there was no formal disclosure process for a vulnerability. The goal was to highlight how legitimate actions can be chained together to achieve malicious results.

Securing AI credentials

The primary defense against this type of attack is strict credential management. Bazalgette advised that organizations should use OAuth or identity federation whenever the platform supports it. If those options are unavailable, keys should be kept as short-lived as possible and have a very narrow scope of permissions.

Security teams are encouraged to treat an AI platform key with the same level of protection as a production credential. This means avoiding storing keys in common locations like shell history, dotfiles, or environment variables. The goal is to ensure that if a machine is compromised, the attacker cannot easily pivot into the AI infrastructure.

The researchers also noted that while the initial breach of a machine is a conventional security problem, the subsequent use of the AI for command and control is a new pattern. Because the actions are allowed by the platform, security teams must look for behavioral anomalies. They should watch for agents moving data at unusual ratios or running with strange command-line arguments.

Detecting anomalous behavior

Since the attack uses legitimate channels and credentials, traditional security tools might not flag the traffic as malicious. Darktrace suggests that detection should focus on correlating the processes an agent launches with the network traffic it generates. Security teams should establish a baseline for how an agent normally behaves during a typical coding task.

An alert should be triggered if a Claude Code process begins moving data to and from the API in a way that deviates from its usual patterns. For example, a coding agent suddenly uploading a large volume of data to a file API might be a sign of exfiltration. The key is identifying legitimate actions that occur in a pattern that bears no resemblance to normal operations.

Ultimately, the researchers argue that 'approved is not the same as safe.' Organizations need to monitor the behavior of their AI agents closely to ensure they are performing the tasks they were intended to do. By focusing on behavior rather than just permissions, teams can better defend against the misuse of AI tools.

Next steps for security

Organizations should begin by auditing how they store and distribute their AI API keys across their development environments. Identifying where keys might be exposed in shell histories or configuration files is a critical first step in reducing the attack surface. Moving toward OAuth-based authentication can provide a more robust way to manage these permissions.

Additionally, teams should consider implementing monitoring for the specific APIs that handle file uploads and memory storage. By tracking the volume and frequency of interactions with these endpoints, security teams can create alerts for potential data exfiltration. This proactive approach helps catch the 'second half' of the attack where the AI is used as a tool for moving data.

As more companies adopt AI agents for complex coding tasks, the risk of these agents being hijacked will likely increase. Staying informed about how these platforms evolve—specifically regarding memory and file management—is essential for maintaining a secure environment. The focus must remain on observing the behavior of the agents to ensure they remain under human control.