Top
Best
New

Posted by takira 17 hours ago

Claude Cowork exfiltrates files(www.promptarmor.com)
733 points | 326 comments
burkaman 17 hours ago|
In this demonstration they use a .docx with prompt injection hidden in an unreadable font size, but in the real world that would probably be unnecessary. You could upload a plain Markdown file somewhere and tell people it has a skill that will teach Claude how to negotiate their mortgage rate and plenty of people would download and use it without ever opening and reading the file. If anything you might be more successful this way, because a .md file feel less suspicious than a .docx.
raincole 10 hours ago||
> because a .md file feel less suspicious than a .docx

For a programmer?

I bet 99.9% people won't consider opening a .docx or .pdf 'unsafe.' Actually, an average white-collar workers will find .md much more suspicious because they don't know what it is while they work with .docx files every day.

AshamedCaptain 3 hours ago|||
For a "modern" programmer a .sh file hosted in some random webserver which you tell him to wget and run would be best.
OoooooooO 1 hour ago|||
sudo run "some link to a shell script"

Never understood why that became so common place ...

4gotunameagain 2 hours ago|||
Shots fired !

I wish you were wrong.

leokennis 5 hours ago||||
> an average white-collar workers will find .md much more suspicious because they don't know what it is while they work with .docx files every day

I think the truly average white collar worker more or less blindly clicks anything and everything if they think it will make their work/life easier...

RCitronsBroker 2 hours ago||
just tell em .md stands for mortgage debater
behnamoh 6 hours ago||||
> an average white-collar workers will find .md much more suspicious

*.dmg files on macOS are even worse! For years I thought they'd "damage" my system...

arghwhat 2 hours ago|||
> For years I thought they'd "damage" my system...

Well, would you argue that the office apps you installed from them didn't cause you damage, physically or emotionally?

mock-possum 5 hours ago|||
It was a rather unfortunate choice of extension
nine_k 6 hours ago|||
Most IT departments educate users about the dangers of macros in MS Office files of suspicious provenance.

The instruction may be in a .txt file, which is usually deemed safe and inert by construction.

bandrami 12 hours ago|||
Isn't one of the main use cases of Cowork "summarize this document I haven't read for me"?
zombot 8 hours ago||
Once again demonstrating that everything comes at a cost. And yet people still believe in a free lunch. With the shit you get people to do because the label says AI I'm clearly in the wrong business.
azan_ 3 hours ago||
There are tons of free lunches everywhere though.
rpigab 1 hour ago|||
People trust their browser nowadays, I'd expect the attack to be even easier if you just render the markdown in html, hiding the injection using plain old css text styling like in the docx but with many more possibilities.

You can even add a nice "copy to clipboard button" that copies something entirely different than what is shown, but it's unnecessary, and people who are more careful won't click that.

fragmede 16 hours ago|||
Mind you, that opinion isn't universal. For programmer and programmer-adjacent technically minded individuals, sure, but there are still places where a pdf for a resume over docx is considered "weird". For those in that bubble, which ostensibly this product targets, md files are what hackers who are going to steal my data use.
burkaman 16 hours ago|||
Yeah I guess I meant specifically for the population that uses LLMs enough to know what skills are.
reactordev 12 hours ago|||
This is why I use signed PDF’s. If a recruiter or manager asks for a docx, I move on.

You’re only going to ever get a read only version.

ajxs 6 hours ago|||
What is this measure defending against (other than getting a job)? The recruiter can still extract the information in your signed PDF, and send their own marked-up version to the client in whatever format they like. Their request for a Word document is just to make that process easier. Many large companies even mandate that recruitment agencies strip all personally-identifiable information out of candidates' resumes[1], to eliminate the possibility of bias.

1: I wish they didn't, because my Github is way more interesting than my professional experience.

jkaplowitz 9 hours ago||||
All PDF security can be stripped by freely available software in ways that allow subsequent modifications without restriction, except the kind of PDF security that requires an unavailable password to decrypt to view, but in that case viewing isn’t possible either.

Subsequent modifications would of course invalidate any digital signature you’ve applied, but that only matters if the recipient cares about your digital signature remaining valid.

Put another way, there’s no such thing as a true read-only PDF if the software necessary to circumvent the other PDF security restrictions is available on the recipient’s computer and if preserving the validity of your digital signature is not considered important.

But sure, it’s very possible to distribute a PDF that’s a lot more annoying to modify than your private source format. No disagreement there.

reactordev 7 hours ago|||
You think a recruiter will be a forensic security researcher? Having document level digital signature is enough for 99% of use cases. Most software that a consumer would have respects the signature and prevents any modifications. Sure, you could manually edit the PDF to remove the document signature security and hope that the embedded JavaScript check doesn’t execute…
darkwater 6 hours ago|||
GP attack vector was probably recruiter editing the CV to put their company name in some place and forward it to some client. They are lazy enough to not even copy-paste the CV.
pluralmonad 10 hours ago||||
Read-only... Until I ctrl-p in Firefox.
reactordev 10 hours ago||
You can’t open it in a browser.

It requires a proper PDF viewer.

w-ll 12 hours ago|||
Care to share your resume? I've built PDF scanning tech before the rise of llms, OCR at the very least will defeat this.
reactordev 7 hours ago|||
Mark-I eyeball is totally capable.
jagged-chisel 11 hours ago|||
Are you talking about defeating digital signatures?
cyanydeez 14 hours ago||
The smart bear versus the unopenable trashcan.
Tiberium 17 hours ago||
A bit unrelated, but if you ever find a malicious use of Anthropic APIs like that, you can just upload the key to a GitHub Gist or a public repo - Anthropic is a GitHub scanning partner, so the key will be revoked almost instantly (you can delete the gist afterwards).

It works for a lot of other providers too, including OpenAI (which also has file APIs, by the way).

https://support.claude.com/en/articles/9767949-api-key-best-...

https://docs.github.com/en/code-security/reference/secret-se...

securesaml 15 hours ago||
I wouldn’t recommend this. What if GitHub’s token scanning service went down. Ideally GitHub should expose an universal token revocation endpoint. Alternatively do this in a private repo and enable token revocation (if it exists)
jychang 15 hours ago|||
You're revoking the attacker's key (that they're using to upload the docs to their own account), this is probably the best option available.

Obviously you have better methods to revoke your own keys.

securesaml 14 hours ago||
it is less of a problem for revoking attacker's keys (but maybe it has access to victim's contents?).

agreed it shouldn't be used to revoke non-malicious/your own keys

nebezb 12 hours ago||
The poster you originally replied to is suggesting this for revoking the attackers keys. Not for revocation of their own keys…
securesaml 11 hours ago|||
there's still some risk of publishing an attacker's key. For example, what if the attacker's key had access to sensitive user data?
throwawaysleep 8 hours ago|||
All the more reason to nuke the key ASAP, no?
avarun 10 hours ago|||
[flagged]
eru 9 hours ago|||
> What if GitHub’s token scanning service went down.

If it's a secret gist, you only exposed the attacker's key to github, but not to the wider public?

OJFord 5 hours ago||
They mean it went down as in stopped working, had some outage; so you've tried to use it as a token revocation service, but it doesn't work (or not as quickly as you expect).
mucle6 16 hours ago|||
Haha this feels like you're playing chess with the hackers
j45 15 hours ago||
Rolling the dice in a new kind of casino.
Davidzheng 9 hours ago|||
I'm being kind of stupid but why does the prompt injection need to POST to anthropic servers at all, does claude cowork have some protections against POST to arbitrary domain but allow POST to anthropic with arbitrary user or something?
rswail 6 hours ago|||
In the article it says that Cowork is running in a VM that has limited network availability, but the Anthropic endpoint is required. What they don't do is check that the API call you make is using the same API key as the one you created the Cowork session with.

So the prompt injection adds a "skill" that uses curl to send the file to the attacker via their API key and the file upload function.

pleurotus 6 hours ago|||
Yeah they mention it in the article, most network connections are restricted. But not connections to anthropic. To spell out the obvious—because Claude needs to talk to its own servers. But here they show you can get it to talk to its own servers, but put some documents in another user's account, using the different API key. All in a way that you, as an end user, wouldn't really see while it's happening.
nh2 15 hours ago|||
So that after the attackers exfiltrate your file to their Anthropic account, now the rest of the world also has access to that Anthropic account and thus your files? Nice plan.
DominoTree 13 hours ago||
For a window of a few minutes until the key gets automatically revoked

Assuming that they took any of your files to begin with and you didn't discover the hidden prompt

sebmellen 17 hours ago|||
Pretty brilliant solution, never thought of that before.
blks 8 hours ago|||
If we consider why this is even needed (people “vibe coding” and exposing their API keys), the word “brilliant” is not coming to mind
darkwater 6 hours ago||
To be fair, people committed tokens into public (and private) repos when "transformers" just meant Optimus Prime or AC to DC.
j45 15 hours ago|||
Except is there a guarantee of the lag time from posting the GIST to the keys being revoked?
sk5t 14 hours ago||
Is this a serious question? Whom do you imagine would offer such a guarantee?

Moreover, finding a more effective way to revoke a non-controlled key seems a tall order.

j45 9 hours ago||
If there’s a delay between jets being posted and disabled they would still be usable no?
trees101 15 hours ago|||
why would you do that rather than just revoking the key directly in the anthropic console?
mingus88 15 hours ago||
It’s the key used by the attackers in the payload I think. So you publish it and a scanner will revoke it
trees101 15 hours ago|||
oh I see, you're force-revoking someone else's key
rswail 6 hours ago||
Which is an interesting DOS attack if you can find someone's key.
OJFord 5 hours ago||
The interesting thing is that (if you're an attacker) your choice of attack is DoS when you have... anything available to you.
freakynit 11 hours ago|||
Does this mean a program can be written to generate all possible api keys and upload to github thereby revoke everyone's access?
kylecazar 11 hours ago||
They are designed to be long enough that it's entirely impractical to do this. All possible is a massive number.
freakynit 11 hours ago||
That's true tho... possible, but impractical.
antonvs 7 hours ago||||
Not possible given the amount of matter in the solar system and the amount of time before the Sun dies.
cortesoft 11 hours ago|||
Only possible if you are unconstrained by time and storage.
eru 9 hours ago||
Not only you, but GitHub too, since you need to upload.

Storage is actually not much of a problem (on your end): you can just generate them on the fly.

lanfeust6 16 hours ago||
Could this not lead to a penalty on the github account used to post it?
bigfatkitten 15 hours ago||
No, because people push their own keys to source repos every day.
lanfeust6 15 hours ago||
Including keys associated with nefarious acts?
edoceo 12 hours ago||
Maybe, the point is that people, in general, commit/post all kinds of secrets they shouldn't into GitHub. Secrets they own, shared secrets, secrets they found, secrets they don't known, etc.

GitHub and their partners just see a secret and trigger the oops-a-wild-secret-has-appeared action.

hombre_fatal 14 hours ago||
One issue here seems to come from the fact that Claude "skills" are so implicit + aren't registered into some higher level tool layer.

Unlike /slash commands, skills attempt to be magical. A skill is just "Here's how you can extract files: {instructions}".

Claude then has to decide when you're trying to invoke a skill. So perhaps any time you say "decompress" or "extract" in the context of files, it will use the instructions from that skill.

It seems like this + no skill "registration" makes it much easier for prompt injection to sneak new abilities into the token stream and then make it so you never know if you might trigger one with normal prompting.

We probably want to move from implicit tools to explicit tools that are statically registered.

So, there currently are lower level tools like Fetch(url), Bash("ls:*"), Read(path), Update(path, content).

Then maybe with a more explicit skill system, you can create a new tool Extract(path), and maybe it can additionally whitelist certain subtools like Read(path) and Bash("tar *"). So you can whitelist Extract globally and know that it can only read and tar.

And since it's more explicit/static, you can require human approval for those tools, and more tools can't be registered during the session the same way an API request can't add a new /endpoint to the server.

xg15 3 hours ago||
I think your conclusion is the right one, but just to note - in OP's example, the user very explicitly told Claude to use the skill. If there is any intransparent autodetection with skills, it wasn't used in this example.
RA_Fisher 12 hours ago||
If they made it clear when skills were being used / monitored that, it'd seem to mitigate a lot of the problem.
adastra22 12 hours ago||
It is shown in the chat log.
reactordev 7 hours ago||
Shown after the fact
adam_patarino 47 minutes ago||
What frustrates me is that Anthropic brags they built cowork in 10 days. They don’t show the seriousness or care required for a product that has access to my data.
lifetimerubyist 8 minutes ago|
The also brag that Claude Code wrote all of the code.

Not a good look.

c7b 6 hours ago||
One thing that kind of baffles me about the popularity of tools like Claude Code is that their main target group seems to be developers (TUI interfaces, semi-structured instruction files,... not the kind of stuff I'd get my parents to use). So people who would be quite capable of building a simple agentic loop themselves [0]. It won't be quite as powerful as the commercial tools, but given that you deeply know how it works you can also tailor it to your specific problems much better. And sandbox it better (it baffles me that the tools' proposed solution to avoid wiping the entire disk is relying on user confirmation [1]).

It's like customizing your text editor or desktop environment. You can do it all yourself, you can get ideas and snippets from other people's setups. But fully relying on proprietary SaaS tools - that we know will have to get more expensive eventually - for some of your core productivity workflows seems unwise to me.

[0] https://news.ycombinator.com/item?id=46545620

[1] https://www.theregister.com/2025/12/01/google_antigravity_wi...

RamblingCTO 6 hours ago||
Because we want to work and not tinker?

> It won't be quite as powerful as the commercial tools

If you are a professional you use a proper tool? SWEs seem to be the only people on the planet that rather used half-arsed solutions instead of well-built professional tools. Imagine your car mechanic doing that ...

fauigerzigerk 4 hours ago|||
I remember this argument being used against Postgres and for Oracle, against Linux and for Windows or AS/400, etc. And I think it makes sense for a certain type of organisation that has no ambition or need to build its own technology competence.

But for everyone else I think it's important to find the right balance in the right areas. A car mechanic is never in the business of building tools. But software engineers always are to some degree, because our tools are software as well.

RamblingCTO 3 hours ago||
But postgres is a professional tool. I don't argue for "use enterprise bullshit". I steer clear of that garbage anyway. SWEs always forget the moat of people focusing their whole work day on a problem and having wider access to information than you do. SWEs forget that time also costs money and oftentimes it's better and cheaper just to pay someone. How much does it cost to ship an internal agent solution that runs automated E2E tests for example (independent of quality)? And how much does a normal SaaS for that cost? Devs have cost and risk attached to their work that is not properly taken into account most of the times.

There is a size of tooling thats fine. Like a small script or simple automation or cli UI or whatever. But if we're talking more complex, 95% of the times a stupid idea.

PS: of course car mechanics built their tools. I work on my car and had to build tools. A hex nut that didn't fit in the engine bay, so I had to grind it down. Normal. Cut and weld an existing tool to get into a tight spot. Normal. That's the simple CLI tool size of a tool. But no one would think about building a car lift or a welder or something.

lpcvoid 5 hours ago||||
You're on hacker news, where people (used to?) like hacking on things. I like tinkering with stuff. I'd take a half working open source project over a enshittified commercial offering any day.
RamblingCTO 3 hours ago||
But hacking and tinkering is a hobby. I also hack and tinker, but that's not work. Sometimes it makes sense. But the mindset is often times "I can build this" and "everything commercial sucks".

> take a half working open source project

See, how is that appropriate in any way in a work environment?

mock-possum 4 hours ago|||
Or more to the point, I get paid to work, not to tinker. I’ve considered doing it on my own time, sure, but not exactly hurting for hobbies right now.

Who has time to mess around with all that, when my employer will just pay for a ready-made solution that works well enough?

manmal 6 hours ago|||
Anyone can build _an_ agent. A good one takes a talented engineer. That’s because TUI rendering is tough (hello, flicker!) and extensibility must be done right lest it‘s useless.

Eg Mario Zechner (badlogic) hit it out of the park with his increasingly popular pi, which does not flicker and is VERY hackable and is the SOTA for going back to previous turns: https://github.com/badlogic/pi-mono/blob/main/packages/codin...

behnamoh 6 hours ago|||
> That’s because TUI rendering is tough (hello, flicker!)

That's just Anthropic's excuse. Literally no other agentic AI TUI suffers from flickers, esp. on tmux Claude Code is unusable.

wiseowise 5 hours ago|||
Huh, nice to see that he has dropped Java. Now if he could only create TS based LibGdx.
Closi 6 hours ago|||
For day-to-day coding, why use your own half-baked solution when the commercial versions are better, cheaper and can be customised anyway?

I've written my own agent for a specialised problem which does work well, although it just burns tokens compared to Cursor!

The other advantage that Claude Code has is that the model itself can be finetuned for tool calling rather than just relying on prompt engineering, but even getting the prompts right must take huge engineering effort and experimentation.

tempaccount420 6 hours ago|||
You would have to pay the API prices, which are many times worse than the subscriptions.
fercircularbuf 4 hours ago||
This is the answer right here as for why I use claude code instead of an api key and someone else's tool.
bogtog 3 hours ago|||
People will pay extra for Opus over Sonnet and often describe the $200 Max plan as cheap because of the time it saves. Paying for a somewhat better harness follows the same logic
rolisz 6 hours ago|||
I've been using Claude code daily almost since it came out. Codex weekly. Tried out Gemini, GitHub copilot cli, AMP, Pi.

None of them ever even tried to delete any files outside of project directory.

So I think they're doing better than me at "accidental file deletion".

imdsm 6 hours ago|||
For what it's worth, Cowork does run inside a sandbox
LaGrange 2 hours ago|||
Ability to actually code something like that is likely inversely correlated with willingness to give Dr Sbaitso access to one’s shell.
singularity2001 5 hours ago||
Found the guy who built Reddit and Postgres himself
patapong 1 hour ago||
The specific issue here seems to be that Anthropic allows the unrestricted upload of personal files to the anthropic cloud environment, but does not check to make sure that the cloud environment belongs to the user running the session.

This should be relatively simple to fix. But, that would not solve the million other ways a file can be sent to another computer, whether through the user opening a compromised .html document or .pdf file etc etc.

This fundamentally comes down to the issue that we are running intelligent agents that can be turned against us on personal data. In a way, it mirrors the AI Box problem: https://www.yudkowsky.net/singularity/aibox

jrjeksjd8d 1 hour ago|
"a superhuman AI that can brainwash people over text" is the dumbest thing I've read this year. It's incredible to me that this guy has some kind of cult following among people who should know better.

The real answer is that people are lazy and as soon as a security barrier forces them to do work, they want to tear down the barrier. It doesn't take a superhuman AI, it just takes a government employee using their personal email because it's easier. There's been a million MCP "security issues" because they're accepting untrusted, unverifiable inputs and acting with lots of permissions.

patapong 50 minutes ago|||
Indeed - the problem here is "How can we prevent a somewhat intelligent, potentially malicious agent from exfiltrating data, with or without human involvement", rather than the superhuman AI stuff. Still a hard problem to solve I think!
3form 58 minutes ago|||
A set of ideas presented to people, and a notion of being smarter for believing in them seems enough to fuel enough of thought-problem-keyboard-warriorism.
rkagerer 11 hours ago||
Cowork is a research preview with unique risks due to its agentic nature and internet access.

The level of risk entailed from putting those two things together is a recipe for diaster.

baby 7 hours ago||
We allowed people to install arbitrary computer programs on their computers decades ago and, sure we got a lot of virus but, this was the best thing ever for computing
kmaitreys 7 hours ago||
This analogy makes no sense. Years ago you gave them the ability to do something. Today you're conditioning them to not use that ability and instead depend on a blackbox.
throwawaysleep 7 hours ago||
Is a cybersecurity problem still a disaster unless it steals your crypto? Security seems rather optional at the moment.
Animats 14 hours ago||
> "This attack is not dependent on the injection source - other injection sources include, but are not limited to: web data from Claude for Chrome, connected MCP servers, etc."

Oh, no, another "when in doubt, execute the file as a program" class of bugs. Windows XP was famous for that. And gradually Microsoft stopped auto-running anything that came along that could possibly be auto-run.

These prompt-driven systems need to be much clearer on what they're allowed to trust as a directive.

adastra22 12 hours ago|
That’s not how they work. Everything input into the model is treated the same. There is no separate instruction stream, nor can there be with the way that the models work.
Animats 10 hours ago||
Until someone comes up with a solution to that, such systems cannot be used for customer-facing systems which can do anything advantageous for the customer.
MarginalGainz 1 hour ago||
Context injection is becoming the new SQL injection. Until we have better isolation layers, letting an LLM 'cowork' on sensitive repos without a middleware sanitization layer is a compliance nightmare waiting to happen.
phyzome 11 hours ago|
There's a sort of milkshake-duck cadence to these "product announcement, vulnerability announcement" AI post pairs.
More comments...