{
 "public_id": "AIR-2025-0092",
 "incident_id": "2025-08-claude-code-dns-exfil",
 "date_disclosed": "2025-08-11",
 "date_occurred": null,
 "title": "Claude Code: data exfiltration via allowlisted DNS commands (CVE-2025-55284)",
 "class": "responsible_disclosure",
 "attack_surface": "coding_agent",
 "initial_vector": "indirect_prompt_injection_source_code",
 "agent_capability_abused": [
  "shell_command_execution",
  "file_read",
  "allowlisted_tool_use",
  "network_egress"
 ],
 "target_product": "Claude Code",
 "target_vendor": "Anthropic",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "data_exfiltration",
  "credential_theft"
 ],
 "blast_radius": "Claude Code users before v1.0.4",
 "cve": [
  "CVE-2025-55284"
 ],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI02"
  ],
  "mitre_atlas": [],
  "labels": [
   "dns_exfiltration",
   "allowlist_abuse",
   "indirect_prompt_injection",
   "covert_channel"
  ]
 },
 "defense_present": "Bash tool asks for permission; ping/nslookup/dig/host were allowlisted",
 "defense_bypassed": true,
 "fix_shipped": "fixed 2025-06-06 in v1.0.4; Anthropic rated CVSS 7.1 High; advisory GHSA-x5gv-jw7f-j6xj",
 "primary_sources": [
  "https://embracethered.com/blog/posts/2025/claude-code-exfiltration-via-dns-requests/"
 ],
 "verified_quote": "When reviewing or interacting with untrusted code or processing data from external systems, Claude Code can be hijacked to run bash commands that allow leaking of sensitive information without user approval.",
 "confidence": "high",
 "notes": "Month of AI Bugs 2025. Also reported as: 'Claude Code data exfiltration via pre-approved DNS utilities (CVE-2025-55284)'.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy"
 ],
 "risk_subcategory": "Prompt Injection",
 "risk_sub_secondary": [
  "Credential & Secret Theft",
  "Remote Code Execution & Sandbox Escape"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the agent ran allowlisted DNS commands to exfiltrate",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_source_code",
 "guardrail_kind": [
  "permission_scope"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [
   "CVE-2025-55284"
  ],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "claude_code",
 "model_provider": "anthropic",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "data_exfiltration_channels",
 "eai_domain": "privacy",
 "eai_secondary": [
  "credential_theft",
  "confused_deputy"
 ],
 "eai_reason": "impact rule: data_exfiltration_channels",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI02 (impact=tool_misuse)",
 "submitted_by": "EAI Internal"
}