Stolen Claude API keys enable Claude Code control

Darktrace researchers demonstrated in a lab test that stolen Claude API keys can turn Claude Code into a remote-controlled implant by utilizing Anthropic's memory stores and Files API. Using a compromised machine and a service running with disabled permission prompts, an operator successfully executed nine jobs on a simulated network to map infrastructure, harvest credentials, download a large file, and exfiltrate data through legitimate API channels. Darktrace noted that the technique relies on normal platform capabilities rather than a software vulnerability, and advised organizations to strictly secure API keys and monitor agent behavior. Open article →