Research demo
ZombAIs: from prompt injection to command and control with Claude Computer Use
AIR-2024-0045 AIR record · 2024-10-anthropic-claude-computer-use-zombais
From the supporting source
This blog post demonstrates that it's possible to leverage prompt injection to achieve, old school, command and control (C2) when giving novel AI systems access to computers.embracethered.com
The record
Disclosed
2024-10-24
Vendor
Anthropic
Product
Claude Computer Use (beta)
Risk domain
Access control and permissions › Privilege escalation
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the agent downloaded and ran the C2 payload
Attack surface
Computer-use agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection web content
Impact type
Remote code execution, C2 control, Persistent compromise
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
hosts running Claude Computer Use against untrusted web content
Capability abused
Defense & remediation
Recorded defense
Anthropic documents the risk; no technical control
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
none - Anthropic treats this as a known beta-feature risk
Taxonomy & references
Curator notes
Johann Rehberger. Published days after Computer Use launched; coined the ZombAI term. | Merged from duplicate id `2024-10-anthropic-computer-use-zombai`. Also reported as: 'ZombAIs: prompt injection turns Claude Computer Use into a C2 implant host'.
Supporting sources
Cite as
Enkrypt AI. "ZombAIs: from prompt injection to command and control with Claude Computer Use". AIR, AIR-2024-0045. https://agentincident.vercel.app/i/AIR-2024-0045/ (accessed 2026-10-19).