The Signal Labs research team at security company Darktrace published the method on its blog on 12 November. Help Net Security reported on it the same day and interviewed Tim Bazalgette, Darktrace’s Chief AI Officer.

The method works only once an attacker has broken into a device and obtained the user’s Claude Console credentials. Darktrace said the technique does not exploit a vulnerability in the Claude platform and that it has not seen the technique in real-world attacks.

Memory files as a command channel

Memory stores are collections of text files attached to a Claude Console workspace. They let agents in the Claude Managed Agents service remember things between sessions. Darktrace said a store can be added to a workspace through the API even if the organisation does not use the service.

The researchers created a store of three files. Claude Code’s harness is the program that controls the agent, gives the model its tools and runs its steps. On start-up, the harness wrote a heartbeat to the first file. The model then fetched a job from the second file, carried it out and wrote the results to the third. The attacker read the results and wrote the next job.

The traffic went to api.anthropic.com, which the agent uses anyway to call the model, so it looked like the agent’s normal work. The jobs were written in natural language. Darktrace said an attacker can give just a goal and let the agent choose the commands itself. In the test, however, some jobs included a ready-made command or script.

Nine jobs on a test network

The test environment mimicked a corporate Active Directory network. A short script found Claude Code on a Linux machine, collected the credentials and created a systemd service that launched harness processes one at a time. Darktrace said the processes ran Claude Sonnet 4.5 in non-interactive mode. Help Net Security reported that they ran with the --dangerously-skip-permissions flag, which turns off confirmation prompts for tool calls.

The agent received nine jobs. It mapped the network and retrieved employee names and a password from an FTP server that allowed anonymous login. It then generated 190 candidate usernames and tried logging in to the domain controller with them and the password. Using the account it found, it listed SMB shares, downloaded a 1 GB file, split it into three parts and uploaded the parts to Claude’s Files API, where the attacker retrieved them.

Bazalgette said Darktrace tested only one platform. Memory stores are a Claude feature, but OpenAI has a comparable file upload API. Darktrace told Anthropic about the findings before publication as a courtesy rather than through formal disclosure because, Bazalgette said, there is no vulnerability.

Detection and key protection

Darktrace advises examining the processes the harness launches and its network traffic together and comparing both with normal activity. Warning signs include unusual command-line parameters or an unusual ratio between the volume of data sent to the API and the volume received from it.

Bazalgette said a standard API key reaches memory stores but OAuth credentials do not. Bazalgette advises using OAuth or identity federation whenever possible, although an OAuth session can also be hijacked, albeit with more difficulty. Otherwise, keys should be short-lived and narrowly scoped, and they must not be left in command history, configuration files or environment variables. ‘Treat an AI platform key as seriously as a production credential, because it now carries comparable capability,’ Bazalgette told Help Net Security.