Disclosed vulnerability
CellShock: Claude for Excel coerced into writing IMAGE() formulas that exfiltrate spreadsheet financials
AIR-2025-0179 AIR record · 2025-11-anthropic-claude-for-excel-cellshock
From the supporting source
Claude for Excel can be coerced by a prompt injection hidden in an untrusted data source to output unsafe formulas that exfiltrate data from the user's file to an attacker.promptarmor.com
The record
Disclosed
2025-11-24
Vendor
Anthropic
Product
Claude for Excel (beta)
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — Claude wrote IMAGE() formulas that fetched attacker URLs with the data
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection spreadsheet hidden text
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Claude for Excel beta users importing untrusted spreadsheet data
Capability abused
Defense & remediation
Recorded defense
warning modal before applying edits; Claude Opus 4.5 injection resistance
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
partial: improved warning modal + model upgrade; modal does not always trigger and invisible Unicode bypasses it
Taxonomy & references
Curator notes
PromptArmor. Injection hidden as blue-on-blue text in an imported sheet. Excel's IMAGE() formula fetches a URL, so appending stolen cell data to the URL leaks it to the attacker's server logs. Tested on Private Beta 11/18 and re-tested on Public Beta 11/24 after mitigations; year inferred as 2025 from the Claude Opus 4.5 / Claude for Excel beta timeline - treat the exact day as approximate. PromptArmor also observed that 'Claude inadvertently covered the attacker's tracks for them' by overwriting the malicious formula with a chart.
Supporting sources
Cite as
Enkrypt AI. "CellShock: Claude for Excel coerced into writing IMAGE() formulas that exfiltrate spreadsheet financials". AIR, AIR-2025-0179. https://agentincident.vercel.app/i/AIR-2025-0179/ (accessed 2026-10-19).