{
 "public_id": "AIR-2026-0011",
 "incident_id": "2026-01-anthropic-claude-cowork-exfiltrates-files",
 "date_disclosed": "2026-01-14",
 "date_occurred": null,
 "title": "Claude Cowork exfiltrates files: injection makes the agent curl user documents into the ATTACKER's Anthropic account via the allowlisted Files API",
 "class": "responsible_disclosure",
 "attack_surface": "computer_use_agent",
 "initial_vector": "indirect_prompt_injection_document_hidden_text",
 "agent_capability_abused": [
  "file_read",
  "code_execution",
  "network_egress_to_allowlisted_domain"
 ],
 "target_product": "Claude Cowork (research preview)",
 "target_vendor": "Anthropic",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "data_exfiltration"
 ],
 "blast_radius": "Claude Cowork research preview users who open an untrusted document",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI05"
  ],
  "mitre_atlas": [],
  "labels": [
   "indirect_prompt_injection",
   "allowlist_abuse",
   "hidden_text_word_doc",
   "no_human_approval",
   "exfil_via_vendor_api"
  ]
 },
 "defense_present": "VM sandbox with outbound network restricted to an allowlist of domains",
 "defense_bypassed": true,
 "fix_shipped": "unpatched at disclosure; Anthropic acknowledged the underlying issue",
 "primary_sources": [
  "https://www.promptarmor.com/resources/claude-cowork-exfiltrates-files"
 ],
 "verified_quote": "Code executed by Claude is run in a VM - restricting outbound network requests to almost all domains - but the Anthropic API flies under the radar as trusted, allowing this attack to complete successfully.",
 "confidence": "high",
 "notes": "PromptArmor. Injection is hidden in a Word document; it instructs Claude to curl the Anthropic file-upload API with the attacker's API key so the victim's file lands in the attacker's Anthropic account. PromptArmor states 'At no point in this process is human approval required.' Same allowlist-abuse pattern that Johann Rehberger reported earlier against Claude.ai chat (see 2025-10-anthropic-claude-pirate ); this record covers the Cowork product surface. Distinct from 2026-07-anthropic-claude-cowork-sharedroot.",
 "risk_category": "privacy",
 "risk_secondary": [],
 "risk_subcategory": "Data Exfiltration via Context",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "Cowork curl'd the user's documents to the attacker's Anthropic account",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_document_hidden_text",
 "guardrail_kind": [
  "sandbox_isolation",
  "permission_scope"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "unknown",
 "model_provider": "anthropic",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "data_exfiltration_channels",
 "eai_domain": "privacy",
 "eai_secondary": [
  "confused_deputy"
 ],
 "eai_reason": "subcategory: Data Exfiltration via Context",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI05 (vector=code_exec)",
 "submitted_by": "EAI Internal"
}