Darktrace shows stolen Claude key can turn coding agent into remote-controlled implant

Darktrace researchers said on Nov. 12, 2026, that a stolen Claude API key can turn Anthropic’s Claude Code coding agent into a remote-controlled implant, demonstrated in Darktrace Signal Labs’ test environment.

The demonstration did not rely on a vulnerability in the Claude platform, and Darktrace has not observed the technique used in the wild. The attack required an initial compromise of a developer’s computer to take the user’s Claude credentials, which sat on the device where the tooling had left them. No guardrail bypass, no refusal, no malicious software, and no strange destination were involved.

A lightweight payload reached the Linux device via a remote staging server and ran shell commands through the dash command interpreter. The payload collected Claude Console API and OAuth credentials and sent them back to the staging server. The staging server replied with identifier details for the memory store and its three memory files.

Memory stores are collections of text files attached to a Claude Console workspace that let agents remember information between sessions. Users can add the files, called memories, via the Claude Console at platform.claude.com or via the RESTful API at api.anthropic.com. An attacker holding stolen API credentials can create a memory store and place memory files inside a workspace assigned to that user, and the API lets organizations add a memory store whether or not they use Claude Managed Agents.

The command-and-control channel relied on a heartbeat file for check-ins, an input file for jobs, and an output file for results. All traffic for jobs and results went through the single inference endpoint. The operator gave jobs as plain English goals, and the agent figured out the commands needed to reach them. The operator dispatched nine jobs through the memory store, with a separate Claude Code harness process acting for each job.

A shell payload created a systemd service, which manages Linux background processes, that kept launching Claude Code with the –dangerously-skip-permissions flag, turning off tool-use confirmation prompts. A transient systemd service unit created by systemd-run spawned Claude Code harness processes that sent timestamped heartbeat messages. The simulation ran on a modeled corporate Active Directory network containing a Linux device, an SMB server, and a domain controller.

The agent mapped the network, found employee names and a password on the anonymous FTP share at 192.168.1.2, and generated 190 candidate usernames. The agent generated 190 candidate usernames. The agent password-sprayed the domain controller and identified the account greg.simon.

Using the compromised credentials, the agent listed SMB shares and found a 1 GB file. The agent retrieved the file, divided it into three parts, and sent the parts to the Claude Files API at api.anthropic.com. The exfiltrated data left the network for Anthropic’s servers, and all names and credentials used in the demonstration were fictitious.

The research took place only in Darktrace Signal Labs’ test environment with Darktrace-controlled accounts and systems, and Darktrace involved no customer environments or customer data. Before publication, Darktrace provided the findings to Anthropic as a courtesy. Darktrace said no formal disclosure process existed because there was no vulnerability to disclose.

Tim Bazalgette, Chief AI Officer at Darktrace, said the team tested only one platform, has not reproduced the result elsewhere, and described the memory stores feature as unique to Claude. Bazalgette said the endpoint used to upload files for data theft has a counterpart at OpenAI. Bazalgette said an attacker could hijack an OAuth session, which is harder to pull off. Exposure depends on whether a provider’s API exposes text storage functionality alongside inference, Bazalgette said.

Bazalgette said exposure also depends on how tightly customers scope credentials and whether customers can see writes to the store. Bazalgette said these are not flaws, but trade-offs involving capability and exposure that deserve review in any deployed agent platform. Nothing after the initial compromise breaks the rules, Bazalgette said.

Bazalgette advised using OAuth or identity federation where possible. Where that is not possible, keys should be short-lived, narrowly scoped, and securely stored, and keys should also be absent from shell history, dotfiles, and environment variables.

“Treat an AI platform key as seriously as a production credential, because it now carries comparable capability,” said Tim Bazalgette, Chief AI Officer at Darktrace. Bazalgette said approved actions through legitimate channels with legitimate credentials are not the same as safe, and only behavior tells the difference. Detection advice calls for correlating agent harness process creation with network traffic and comparing both against baseline behavior. Defenders should flag odd command-line arguments or unusual data transfer ratios.

Separately, Apiiro said on Nov. 6, 2026, that it found 104,185 copies of the .claude/settings.local.json file in public GitHub repositories, and 1,122 copies held at least one secret. The exposed files held 1,379 different secrets, including 379 database passwords, 43 SSH logins, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys.

When a user chooses not to be asked again, Claude Code stores approved shell commands exactly as typed, along with any embedded secrets, in .claude/settings.local.json. The ignore rule set globally for the file does not move with the project. Accidental commits happen when a repository is cloned to a new machine or a folder is later turned into a repository. Researchers reproduced the behavior with the latest models, Opus 5.5 and Fable 5.1.

Gitleaks and TruffleHog missed 215 of the 1,122 files that held secrets. Because passwords entered in commands look like normal words on normal command lines, scanners overlook them. One company notified earlier in the week confirmed to Apiiro that its key had been live.

The owners of the exposed files include 63 organizations, most of which are software companies of every size. All files containing secrets remained on their repositories’ default branches. For at least 217 days, half of those repositories had kept the file on the default branch.

Older file versions hold 734 secrets across 509 repositories absent from any current copy. Forks propagated the secrets: 211 forks across 74 repositories carry identical secrets to the originals. The shared .claude/settings.json file contains secrets in 298 of 76,011 copies, most within allow rules. Combining older versions and saved agent chat logs yields 2,539 secrets across 1,994 repositories.

Apiiro’s researchers say to rotate every password, token, and key the settings file ever held before cleaning up, because secrets persist in git history and forks. Files that were never uploaded to GitHub can still expose secrets through npm packages, Docker images, zip archives, or synced folders. The Shai-Hulud worm ran TruffleHog on infected computers in September 2025, flagging over half of the files as containing secrets.

A bug report dated Aug. 11, 2025, said settings.local.json saved commands with API keys and tokens word-for-word. An automated bot marked the August 2025 report as not planned on Jan. 3, after 60 days with no activity. The same bot closed all four related reports cited by the researchers without any reply from Anthropic.

Before this work, Darktrace Signal Labs studied ways to bypass AI system guardrails so models would follow harmful instructions. Public reports name QUIETVAULT, s1ngularity, SANDWORM_MODE, and DUSTMAKER as credential stealers that use AI agents but do not have an interactive feedback loop. With a feedback loop, an attacker could watch results in real time and change instructions on the fly, turning the agent into an intelligent insider.