Stolen Claude API keys can turn Claude Code into a remote-controlled implant

Darktrace researchers have shown how stolen API keys can be used to turn Anthropic's Claude Code into a remote-controlled implant, a technique that could pose significant security risks if exploited. The researchers conducted a lab test where they manipulated the Claude platform's memory stores feature to extract a 1 GB file through the Claude Files API, making it appear as if the traffic was legitimate coding activity. This method requires initial access to a developer's machine to obtain Claude credentials, which are often stored locally by user tools.

The technique demonstrated by Darktrace does not exploit a vulnerability in the Claude platform itself, and there have been no reports of it being used in the wild. Instead, it relies on the ability to access a developer's machine and extract Claude credentials. Once in possession of these credentials, an attacker can set up a system that interacts with Claude's memory stores, which are designed to help agents remember tasks between sessions. The researchers found that memory stores can be added to a Claude Console workspace via the API, even if the organization does not utilize Claude Managed Agents.

In their test, Darktrace researchers created a memory store with three files. Each Claude Code process would check in with a heartbeat file, read a job from an input file, execute the task, and then post results to an output file. This setup allowed an operator to assign tasks in plain English, letting the model determine the necessary commands. The experiment was conducted on a simulated corporate network, where a small shell payload was used to find Claude Code on a Linux machine, collect credentials, and establish a systemd service that launched Claude Code processes with a specific flag to bypass tool-use confirmations.

The researchers demonstrated the technique by sending nine jobs through the memory store. The agent mapped the local network, retrieved employee names and a password from an anonymous FTP share, generated potential usernames, and used the password to access the domain controller. This led to the identification of an account, listing of SMB shares, and downloading of a 1 GB file, which was then split and uploaded to the Files API. All data exfiltration was routed through Anthropic's servers, blending in with regular traffic.

Tim Bazalgette, Darktrace's Chief AI Officer, noted that while the memory stores feature is specific to Claude, similar file-upload endpoints exist in other AI platforms. The key factors influencing exposure include the API's text storage capabilities and how credentials are managed. Bazalgette advises using OAuth or identity federation when possible, and securing API keys by making them short-lived, narrowly scoped, and stored securely. Treating AI platform keys with the same seriousness as production credentials is crucial, given their potential capabilities.

Darktrace's detection strategy involves correlating agent process launches with network traffic, comparing these against a baseline to identify anomalies. Unusual command-line arguments or data transfer patterns can indicate misuse, despite the actions being legitimate through approved channels.