Disclosed vulnerability
Claude Pirate: abusing Anthropic's own Files API as the exfiltration channel out of the Claude sandbox
AIR-2025-0160 AIR record · 2025-10-anthropic-claude-pirate
From the supporting source
Rather than leaking data via chat API, there is a Files API, which allows uploading entire files to Claude.embracethered.com
The record
Disclosed
2025-10-28
Vendor
Anthropic
Product
Claude with Code Interpreter and network access
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the agent uploaded up to 30MB to the attacker's Anthropic account
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection document
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Claude users with the default 'Package managers only' egress setting
Capability abused
Defense & remediation
Recorded defense
network egress allowlist restricted to package managers, which still included api.anthropic.com
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
not stated; Anthropic first closed the HackerOne report as out of scope on 2025-10-25, then confirmed on 2025-10-30 that data exfiltration should be in scope
Taxonomy & references
Curator notes
Up to 30MB per upload, sent to an attacker-controlled Anthropic account using attacker-supplied API credentials.
Supporting sources
Cite as
Enkrypt AI. "Claude Pirate: abusing Anthropic's own Files API as the exfiltration channel out of the Claude sandbox". AIR, AIR-2025-0160. https://agentincident.vercel.app/i/AIR-2025-0160/ (accessed 2026-10-19).