[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhchAc1CiYGIlpXTW-8WfSBmPdEMC7Rh_n9bpHGauYXQ":3},{"article":4,"iocs":53,"watch_terms":54,"solutions":55,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"34f718a2-4ef2-42c4-af77-7b0ff8e84ecd","Stolen Claude API keys can turn Claude Code into a remote-controlled implant","stolen-claude-api-keys-can-turn-claude-code-into-a-remote-controlled-implant-928a14","Darktrace researchers turned Claude Code into a remote-controlled implant in a lab test, steering the coding agent through the memory stores feature of Anthropic’s Claude platform and pulling a 1 GB file out through the Claude Files API. Once the agent was set up, every job and every result traveled through api.anthropic.com, the endpoint the agent already calls for inference, so the attacker’s traffic looked like a coding agent doing its job. The technique needs … More → The post Stolen Claude API keys can turn Claude Code into a remote-controlled implant appeared first on Help Net Security.","Darktrace researchers demonstrated how stolen API keys for Anthropic's Claude Code can turn the AI agent into a remote-controlled implant. By leveraging the 'memory stores' feature, attackers can issue commands and exfiltrate data, with all traffic appearing as legitimate agent activity. This technique requires initial compromise of a developer's machine to obtain credentials and does not exploit a vulnerability in the Claude platform itself.","Stolen Claude API keys allow Claude Code to be controlled remotely for data exfiltration.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F12\u002Fstolen-claude-api-keys-remote-controlled-implant\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002F12064238\u002Fclaude-hand-1500.webp","2026-11-12T11:00:21+00:00","2026-11-12T12:00:20.310992+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"Claude Code","product",{"name":21,"type":22},"Anthropic","vendor",{"name":24,"type":25},"API","technology",{"name":27,"type":25},"Active Directory",{"name":29,"type":22},"Darktrace","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":52},{"id":30,"icon":32,"name":33,"slug":34},[],[21,29,18],{"controls":56,"vendors":140},[57,85,114],{"slug":58,"name":59,"problem":60,"products":61},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[62,70,77],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":58,"product_name":74,"url":75,"description":76},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":86,"name":87,"problem":88,"products":89},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"slug":115,"name":116,"problem":117,"products":118},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":136,"product_name":137,"url":138,"description":139},"cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",[141],{"slug":142,"name":29,"logo_path":143,"roles":144},"darktrace","\u002Fvendor-logos\u002Fdarktrace.png",[145],"reported_by",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":156},"stolen-ai-api-keys-enable-covert-command-and-control-via-claude-code","Stolen AI API Keys Enable Covert Command-and-Control via Claude Code","Researchers showed that once an attacker obtains a developer's Claude API credentials—through phishing, malware, or credential theft—they can hijack Claude Code's memory-store feature to issue commands and exfiltrate data, with all activity blending seamlessly into normal AI agent traffic. The core failure is not a platform vulnerability but rather inadequate protection of API keys and insufficient monitoring of AI agent behavior. This matters because developers routinely store powerful API credentials insecurely (in dotfiles, environment variables, or plaintext configs), and organizations have no tooling in place to distinguish legitimate AI agent actions from attacker-directed ones. As AI coding agents gain broader filesystem and network access, the blast radius of a single stolen credential grows dramatically.",[151,152,153,154,155],"CIS Control 3: Data Protection (v8)","CIS Control 6: Access Control Management (v8)","NIST SP 800-53 IA-5: Authenticator Management","NIST CSF 2.0 DE.CM-01: Monitoring","MITRE ATT&CK T1552.001: Credentials in Files",{"NIST CSF 2.0 DE.CM-01: Monitoring":157,"CIS Control 3: Data Protection (v8)":158,"MITRE ATT&CK T1552.001: Credentials in Files":159,"CIS Control 6: Access Control Management (v8)":160,"NIST SP 800-53 IA-5: Authenticator Management":161},"DE.CM-01 asks organizations to monitor information systems for anomalous activity; had AI agent traffic been instrumented and baselined, the attacker's command-and-control use of memory stores could have been detected.","CIS Control 3 requires identifying and protecting sensitive data assets, including API keys and credentials, which were left insufficiently protected and enabled the attacker to weaponize the AI agent.","This technique describes adversaries searching for credentials stored in plaintext files and environment variables, which is the initial step required to steal the Claude API key and execute this attack.","CIS Control 6 calls for managing access credentials with least privilege and secrets management practices that, if applied to AI API keys, would have limited the attacker's ability to abuse Claude Code.","IA-5 requires protecting authenticators such as API keys from disclosure, which is the precise control whose absence allowed a stolen key to become a persistent implant channel."]