Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Cowork exfiltrates files

promptarmor.com

Post reply on HN
Print view View original

271–280 of 419 posts

Re: Claude Cowork exfiltrates files

#271

Post by darkwater »

jkaplowitz wrote: post #245
reactordev wrote: post #184

Earlier quoted context omitted.

This is why I use signed PDF’s. If a recruiter or manager asks for a docx, I move on. You’re only going to ever get a read only version.

All PDF security can be stripped by freely available software in ways that allow subsequent modifications without restriction, except the kind of PDF security that requires an unavailable password to decrypt to view, but in that case viewing isn’t possible either. Subsequent modifications would of course invalidate any digital signature you’ve applied, but that only matters if the recipient cares about your digital s…

GP attack vector was probably recruiter editing the CV to put their company name in some place and forward it to some client. They are lazy enough to not even copy-paste the CV.

Re: Claude Cowork exfiltrates files

#272

Post by pleurotus »

Davidzheng wrote: post #243
Tiberium wrote: post #30

A bit unrelated, but if you ever find a malicious use of Anthropic APIs like that, you can just upload the key to a GitHub Gist or a public repo - Anthropic is a GitHub scanning partner, so the key will be revoked almost instantly (you can delete the gist afterwards). It works for a lot of other providers too, including OpenAI (which also has file APIs, by the way). https://support.claude.com/en/articles/9767949-api-…

I'm being kind of stupid but why does the prompt injection need to POST to anthropic servers at all, does claude cowork have some protections against POST to arbitrary domain but allow POST to anthropic with arbitrary user or something?

Yeah they mention it in the article, most network connections are restricted. But not connections to anthropic. To spell out the obvious—because Claude needs to talk to its own servers. But here they show you can get it to talk to its own servers, but put some documents in another user's account, using the different API key. All in a way that you, as an end user, wouldn't really see while it's happening.

Re: Claude Cowork exfiltrates files

#273

Post by tuananh »

this attack is quite nice.

- currently we have no skills hub, no way to do versioning, signing, attestation for skills we want to use.

- they do sandboxing but probably just simple whitelist/blacklist url. they ofcourse needs to whitelist their own domains -> uploading cross account.

Re: Claude Cowork exfiltrates files

#274

Post by darkwater »

blks wrote: post #247
sebmellen wrote: post #31

Earlier quoted context omitted.

Pretty brilliant solution, never thought of that before.

If we consider why this is even needed (people “vibe coding” and exposing their API keys), the word “brilliant” is not coming to mind

To be fair, people committed tokens into public (and private) repos when "transformers" just meant Optimus Prime or AC to DC.

Re: Claude Cowork exfiltrates files

#275

Post by c7b »

One thing that kind of baffles me about the popularity of tools like Claude Code is that their main target group seems to be developers (TUI interfaces, semi-structured instruction files,... not the kind of stuff I'd get my parents to use). So people who would be quite capable of building a simple agentic loop themselves [0]. It won't be quite as powerful as the commercial tools, but given that you deeply know how it works you can also tailor it to your specific problems much better. And sandbox it better (it baffles me that the tools' proposed solution to avoid wiping the entire disk is relying on user confirmation [1]).

It's like customizing your text editor or desktop environment. You can do it all yourself, you can get ideas and snippets from other people's setups. But fully relying on proprietary SaaS tools - that we know will have to get more expensive eventually - for some of your core productivity workflows seems unwise to me.

[0] https://news.ycombinator.com/item?id=46545620

[1] https://www.theregister.com/2025/12/01/google_antigravity_wi...

Re: Claude Cowork exfiltrates files

#276

Post by fathermarz »

tempaccsoz5 wrote: post #225
fathermarz wrote: post #201

This is getting outrageous. How many times must we talk about prompt injection. Yes it exists and will forever. Saying the bad guys API key will make it into your financial statements? Excuse me?

The example in this article is prompt injection in a "skill" file. It doesn't seem unreasonable that someone looking to "embrace AI" would look up ways to make it perform better at a certain task, and assume that since it's a plain text file it must be safe to upload to a chatbot

I have a hard time with this one. Technical people understand a skill and uploading a skill. If a non-technical person learns about skills it is likely through a trusted person who is teaching them about them and will tell them how to make their own skills.

As far as I know, repositories for skills are found in technical corners of the internet.

I could understand a potential phish as a way to make this happen, but the crossover between embrace AI person and falls for “download this file” phishes is pretty narrow IMO.

Re: Claude Cowork exfiltrates files

#277

Post by ajxs »

reactordev wrote: post #184
fragmede wrote: post #34

Earlier quoted context omitted.

Mind you, that opinion isn't universal. For programmer and programmer-adjacent technically minded individuals, sure, but there are still places where a pdf for a resume over docx is considered "weird". For those in that bubble, which ostensibly this product targets, md files are what hackers who are going to steal my data use.

This is why I use signed PDF’s. If a recruiter or manager asks for a docx, I move on. You’re only going to ever get a read only version.

What is this measure defending against (other than getting a job)? The recruiter can still extract the information in your signed PDF, and send their own marked-up version to the client in whatever format they like. Their request for a Word document is just to make that process easier. Many large companies even mandate that recruitment agencies strip all personally-identifiable information out of candidates' resumes[1], to eliminate the possibility of bias.

1: I wish they didn't, because my Github is way more interesting than my professional experience.

Re: Claude Cowork exfiltrates files

#278

Post by tempaccount420 »

c7b wrote: post #275

One thing that kind of baffles me about the popularity of tools like Claude Code is that their main target group seems to be developers (TUI interfaces, semi-structured instruction files,... not the kind of stuff I'd get my parents to use). So people who would be quite capable of building a simple agentic loop themselves [0]. It won't be quite as powerful as the commercial tools, but given that you deeply know how it…

You would have to pay the API prices, which are many times worse than the subscriptions.

Re: Claude Cowork exfiltrates files

#279

Post by rswail »

Davidzheng wrote: post #243
Tiberium wrote: post #30

A bit unrelated, but if you ever find a malicious use of Anthropic APIs like that, you can just upload the key to a GitHub Gist or a public repo - Anthropic is a GitHub scanning partner, so the key will be revoked almost instantly (you can delete the gist afterwards). It works for a lot of other providers too, including OpenAI (which also has file APIs, by the way). https://support.claude.com/en/articles/9767949-api-…

I'm being kind of stupid but why does the prompt injection need to POST to anthropic servers at all, does claude cowork have some protections against POST to arbitrary domain but allow POST to anthropic with arbitrary user or something?

In the article it says that Cowork is running in a VM that has limited network availability, but the Anthropic endpoint is required. What they don't do is check that the API call you make is using the same API key as the one you created the Cowork session with.

So the prompt injection adds a "skill" that uses curl to send the file to the attacker via their API key and the file upload function.

Re: Claude Cowork exfiltrates files

#280

Post by imdsm »

c7b wrote: post #275

One thing that kind of baffles me about the popularity of tools like Claude Code is that their main target group seems to be developers (TUI interfaces, semi-structured instruction files,... not the kind of stuff I'd get my parents to use). So people who would be quite capable of building a simple agentic loop themselves [0]. It won't be quite as powerful as the commercial tools, but given that you deeply know how it…

For what it's worth, Cowork does run inside a sandbox
Post reply on HN