Just days after Anthropic unveiled Claude Cowork, security researchers documented a critical vulnerability that lets attackers steal confidential user files through hidden prompt injections, a well-known issue of AI systems.
Anthropic's new agentic AI system Claude Cowork is vulnerable to file exfiltration through indirect prompt injection, according to security researchers at PromptArmor. They documented the flaw just two days after the Research Preview went live.
The vulnerability stems from an isolation flaw in Claude's code execution environment that was already known before Cowork existed. According to PromptArmor, security researcher Johann Rehberger had previously identified and disclosed the issue in Claude.ai chat. Anthropic acknowledged the problem but allegedly never fixed it.
Malicious commands hide in plain sight
The attack chain PromptArmor documented starts when a user connects Cowork to a local folder containing confidential data. The attacker then gets a file with a hidden prompt injection into that folder.
