Darktrace: stolen Claude API keys can turn Claude Code into a remote-controlled implant

On November 12, 2026, Darktrace researchers published a lab demonstration in which an attacker who had already broken into a developer's machine, and had stolen that developer's Claude Console API credentials, turned the installed Claude Code agent into a remotely controlled tool. Commands went in through Claude's "memory stores" feature and stolen data came out through the Files API, so all traffic looked like normal calls to Anthropic's API. Darktrace says this is not a vulnerability in Claude and has not been seen in the wild. Teams that use Claude Code should still treat Claude API keys like production credentials, and they can block the "skip all permission prompts" mode on managed machines.

What happened, in plain English

Claude Code is Anthropic's AI coding agent. It runs on a developer's computer, reads and writes files, and runs terminal commands on the developer's behalf. To work, it needs credentials for Anthropic's service, usually an API key (application programming interface key, a long secret string that works like a password for software) or a sign-in token.

Darktrace's team, Moishe Tajtelbaum and Sam Lister, asked what an intruder could do with those credentials once they were already on a developer's machine. Their answer: the intruder can use the agent as their own remote operator.

The trick relies on two normal Claude platform features:

• Memory stores are collections of text files kept in a Claude Console workspace, meant to give AI agents memory between sessions. The researchers used three of these files as a mailbox: one for "I'm alive" check-ins, one for the attacker's instructions, and one for the results.
• The Files API lets programs upload files to Anthropic. The researchers used it to take data out.

An analogy: a burglar who gets into an office doesn't bring their own walkie-talkie. They use the company's internal mail system, which security guards already trust and don't open.

The attacker writes plain-English tasks ("map the network", "find a file share"), the agent works out the commands, and the results come back the same way. Because every request goes to api.anthropic.com, the address the agent talks to all day anyway, network monitoring sees nothing unusual.

Are you affected? What to do now

Most readers have nothing urgent to do. This is a lab demonstration, not an active campaign, and it needs two things an attacker must already have: control of a developer's computer, and that developer's Claude Console API credentials. If an attacker has both, you already have a serious incident. What this research changes is how much damage they can do quietly afterwards.

You should review your setup if your developers use Claude Code with Claude Console API keys (pay-per-use API billing), especially static keys kept on laptops or CI runners (continuous integration servers that build and test code).

Checklist:

• Find where Claude credentials live. On Linux, Claude Code stores its login in ~/.claude/.credentials.json. On macOS it uses the Keychain, with that same file as a fallback. On Windows it uses %USERPROFILE%\.claude\.credentials.json. Also check environment variables (ANTHROPIC_API_KEY), dotfiles, shell history and CI secrets (Anthropic docs).
• Prefer sign-ins over static keys. Darktrace's Chief AI Officer, Tim Bazalgette, told Help Net Security that standard API keys could reach memory stores while OAuth credentials (the token-based sign-in Claude Code uses with a claude.ai or Console account) could not. Claude Code supports signing in to a Console account without creating an API key, and an apiKeyHelper script that fetches short-lived keys from a secrets vault.
• Scope keys narrowly. Memory stores are tied to a workspace. Keep keys limited to the workspace a team actually needs (workspaces).
• Block the "no prompts" mode on managed machines. In the demo, Claude Code was relaunched over and over with all permission prompts switched off. Administrators can block this by setting permissions.disableBypassPermissionsMode to "disable" in Claude Code managed settings (permission modes).
• Audit memory stores and uploaded files in each Console workspace. Investigate any you did not create. Each change to a memory creates a version tied to the session that wrote it, but past versions may be deleted after 30 days unless exported (memory docs).
• Add detection. Alert when the agent is started by background services (for example systemd-run or cron) outside approved automation. Also alert when agent processes run network or file-share tools, and when a host that normally only sends prompts suddenly uploads large amounts of data to the AI API.
• If you suspect a compromise, rotate Claude keys alongside the other credentials on that machine.

Neither Darktrace nor Anthropic has published network indicators of compromise for this technique.

The expert view

Root cause. There is no bug. The technique abuses documented features with stolen credentials, and Darktrace says so plainly: it "does not rely on a vulnerability in the Claude platform." The real issue is architectural. AI platform APIs now combine inference (model calls) with general-purpose storage: memory stores, file uploads, persistent agent state. Any API that pairs storage with a key a developer keeps on disk can be used as a dead-drop.

The chain, conceptually. In the lab (a simulated Active Directory network with fake data), a small script found Claude Code on a Linux host, collected the user's Console credentials and set up a recurring background job to relaunch the agent. Each run, the agent, driven by a Claude Sonnet 4.5 model in non-interactive mode, read a task from the memory store, carried it out with its normal shell tools and wrote the results back. Across nine tasks, it mapped the network, built 190 usernames from data on an anonymous FTP share, sprayed a password against the domain controller, found a matching account, listed SMB file shares, and uploaded a 1 GB file in three parts through the Files API.

Why defenses miss it. This is "living off the land" moved up a layer, which Darktrace calls "living off the AI." Endpoint tools see a sanctioned developer tool running ordinary commands. Network tools see TLS (encrypted) traffic to an allow-listed AI vendor. Blocking the domain would break the developers' own work. The attacker no longer needs custom malware that can be caught by its signature, because the "implant" is the company's own agent. MITRE ATLAS already tracks AI-service abuse as a technique class, and earlier malware has used the OpenAI Assistants API as a relay, so the pattern is not new. Here, though, the AI also does the hands-on work.

Severity in context. There is no CVE or CVSS score, because there is no flaw to score. The headline risk is easy to overstate: an attacker who already owns a developer endpoint can do a lot without Claude. The risk is still easy to understate, because the technique makes follow-on activity much quieter and needs very little attacker skill. The credential-theft piece is not hypothetical. Darktrace notes that recent malware campaigns already harvest credentials from developer machines and hand that work to AI agents.

What is still unknown. Darktrace tested only Claude. Bazalgette said OpenAI has an equivalent file-upload endpoint but the team has not reproduced the technique elsewhere. Darktrace's write-up says Anthropic is not affiliated with and has not endorsed the research, and Help Net Security reports the findings were shared with Anthropic as a courtesy. As of November 14, Anthropic has made no public statement. It is also not yet clear what logging Anthropic offers customers for memory-store and file activity that security teams could feed into their monitoring.

Official sources

• Darktrace: Living off the AI — Shared memories as a covert C2 channel (November 12, 2026)
• Anthropic docs: Using agent memory (memory stores, versions, retention)
• Anthropic docs: Files API
• Claude Code docs: Authentication and credential storage
• Claude Code docs: Permission modes and disabling bypass mode
• Coverage: Help Net Security — Stolen Claude API keys can turn coding agents into remote-controlled implants
• Coverage: Cloud Security Alliance research note (November 13, 2026)