Security researcher Prompt Armor disclosed a creative workaround that causes Claude Cowork to exfiltrate files by abusing Anthropic's allowed API domain. The attack supplies an attacker's Anthropic API key and directs the agent to upload accessible files to https://api.anthropic.com/v1/files, enabling the attacker to retrieve their contents later. The finding shows outbound-domain whitelists alone may not stop prompt-injection data theft.
Key Points
- 1Uploads files via allowed api.anthropic.com domain to /v1/files, using attacker's Anthropic API key
- 2Bypasses outbound-domain restriction, enabling prompt-injection attacks despite network whitelist protections
- 3Requires stricter egress policies and credential handling; audit agents' allowed domains and API key use
Scoring Rationale
High practical impact and clear exploit demonstration, limited by single-source reporting and no vendor mitigation yet.
Sources
Public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
