Disclosed vulnerability
Claude Cowork exfiltrates files: injection makes the agent curl user documents into the ATTACKER's Anthropic account via the allowlisted Files API
AIR-2026-0011 AIR record · 2026-01-anthropic-claude-cowork-exfiltrates-files
From the supporting source
Code executed by Claude is run in a VM - restricting outbound network requests to almost all domains - but the Anthropic API flies under the radar as trusted, allowing this attack to complete successfully.promptarmor.com
The record
Disclosed
2026-01-14
Vendor
Anthropic
Product
Claude Cowork (research preview)
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — Cowork curl'd the user's documents to the attacker's Anthropic account
Attack surface
Computer-use agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection document hidden text
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Claude Cowork research preview users who open an untrusted document
Capability abused
Defense & remediation
Recorded defense
VM sandbox with outbound network restricted to an allowlist of domains
Guardrail kinds
Sandbox isolation, Permission scope
Guardrail outcome
Silent
Fix shipped
unpatched at disclosure; Anthropic acknowledged the underlying issue
Taxonomy & references
Curator notes
PromptArmor. Injection is hidden in a Word document; it instructs Claude to curl the Anthropic file-upload API with the attacker's API key so the victim's file lands in the attacker's Anthropic account. PromptArmor states 'At no point in this process is human approval required.' Same allowlist-abuse pattern that Johann Rehberger reported earlier against Claude.ai chat (see 2025-10-anthropic-claude-pirate ); this record covers the Cowork product surface. Distinct from 2026-07-anthropic-claude-cowork-sharedroot.
Supporting sources
Cite as
Enkrypt AI. "Claude Cowork exfiltrates files: injection makes the agent curl user documents into the ATTACKER's Anthropic account via the allowlisted Files API". AIR, AIR-2026-0011. https://agentincident.vercel.app/i/AIR-2026-0011/ (accessed 2026-10-19).