Anthropic Claude Flaws Let Attackers Exfiltrate Data, Redirect Users

Key Takeaways

• A chain of three vulnerabilities, dubbed “Claudy Day,” was found in Anthropic’s Claude.ai, enabling data exfiltration and user redirection.
• The flaws leveraged invisible prompt injection, data exfiltration via the Anthropic Files API, and an open redirect on claude.com.
• Attackers could silently steal sensitive conversation data and redirect users to malicious sites without requiring complex integrations or tools.
• Anthropic has patched the primary prompt injection vulnerability, with other issues currently under remediation.
• Users and enterprises should exercise caution with pre-filled prompts and review AI agent permissions.

Security researchers have uncovered a critical series of vulnerabilities within Anthropic’s popular AI assistant, Claude.ai, allowing attackers to discreetly steal sensitive user data and reroute individuals to malicious external sites. The exploit, dubbed “Claudy Day,” combines three distinct weaknesses within the platform, creating a seamless attack chain that does not require sophisticated setup or external server configurations.

Following responsible disclosure to Anthropic, the most critical component of this chain—a prompt injection flaw—has been addressed. The remaining vulnerabilities are actively being remediated.

The Claudy Day Vulnerability Chain

The “Claudy Day” attack vector exploits a combination of three independent flaws on the claude.com platform:

Invisible Prompt Injection via URL Parameters

Claude.ai facilitates pre-filled chat prompts through URL parameters, such as claude.ai/new?q=.... This feature is designed to allow users or third parties to initiate a chat session with pre-loaded text. Researchers discovered that specific HTML tags embedded within this parameter could be rendered invisible within the chat input field while still being fully processed by Claude upon submission. This technique allowed attackers to conceal arbitrary instructions, including commands designed for data extraction, within what appeared to be a standard, innocuous prompt, completely hidden from the victim’s view.

Data Exfiltration via the Anthropic Files API

While Claude’s code execution sandbox generally restricts most outbound network connections, it permits traffic to api.anthropic.com. By embedding an attacker-controlled API key within the hidden prompt injection payload, researchers demonstrated that Claude could be instructed to scan the user’s conversation history for sensitive information. This data could then be compiled into a file and silently uploaded to the attacker’s own Anthropic account via the Files API. The attacker could then retrieve the exfiltrated data at their discretion, without needing any external tools or third-party integrations.

Open Redirect on claude.com

A significant flaw was identified where any URL structured as claude.com/redirect/<target> would redirect users to arbitrary third-party domains without proper validation. Researchers demonstrated how this could be weaponized, particularly with platforms like Google Ads, which validate advertisements by hostname. An attacker could create a paid advertisement displaying a legitimate claude.com URL. Upon clicking, this URL would silently forward the victim to the attacker’s malicious injection URL, making the transition virtually indistinguishable from a genuine Claude search result. More details on this can be found in the researcher’s blog post.

Impact and Broader Implications

Even in a default Claude.ai session, user conversation history can contain highly sensitive information, ranging from business strategies and financial plans to medical concerns, personal relationships, and login-adjacent data. Through the injection payload, an attacker could instruct Claude to summarize past conversations to profile the user, extract specific chats related to sensitive topics like a pending acquisition or a health diagnosis, or even allow the AI model to autonomously identify and exfiltrate what it deems to be the most critical content.

For enterprise environments utilizing Claude.ai with integrated MCP servers, file integrations, or API connections, the potential impact expands significantly. Injected instructions could allow the AI to read documents, send messages on behalf of the user, and interact with any connected business service, all executed silently before the user has an opportunity to intervene. Google Ads’ granular targeting capabilities, including Customer Match for specific email addresses, further enable attackers to precisely target high-value individuals.

Anthropic has confirmed that the prompt injection vulnerability has been fixed, and work is underway to address the remaining issues. This disclosure follows previous research into “OpenClaw,” highlighting a recurring pattern: AI agents with broad access can be compromised through single, manipulated inputs, underscoring the limitations of traditional identity and access management frameworks in the context of autonomous AI behavior.

What You Should Do

• For Anthropic Claude.ai Users: Be cautious of pre-filled prompts or shared Claude links, as they may contain hidden instructions. Treat any unexpected or unsolicited links with suspicion.
• For Enterprises Using Claude.ai: Conduct a comprehensive audit of all AI agent integrations. Disable any permissions that are not strictly necessary to reduce the potential attack surface.
• Educate Users: Inform employees and users about the risks associated with pre-filled prompts and shared AI links, emphasizing that such links can carry hidden, malicious instructions.
• Implement Robust Access Controls: Treat AI agents with the same level of scrutiny as human users and service accounts. Apply intent analysis, scoped just-in-time access, and maintain full audit trails for AI agent actions, especially for agents that hold credentials or perform autonomous operations.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.