Claude Cowork Exfiltrates Files

What it is

A working data-exfiltration attack against the Claude Cowork research preview, from PromptArmor's Threat Intel Team (led by qual1a). It reuses a vulnerability Johann Rehberger disclosed earlier for Claude.ai chat — acknowledged but not remediated by Anthropic — which now also affects Cowork.

How it works

The turn on which the whole thing hinges is a trust-boundary gap: Cowork runs Claude-generated code in a VM that blocks outbound network requests to nearly all domains, but the Anthropic API is allowlisted as trusted. A prompt injection tells Claude to curl the victim's largest local file to the Anthropic file-upload API using an attacker-supplied API key, so the file lands in the attacker's account where they can chat with it. The exfiltrated file in the demo held financial figures and PII including partial SSNs.

The novel delivery detail: the injection is hidden not in the usual Markdown Skill file but in a .docx posing as a Skill, using 1-point white-on-white text with line spacing 0.1 — PromptArmor calls this "effectively impossible to detect."

flowchart LR
  A[Malicious .docx 'Skill'<br/>hidden injection] --> B[User asks Cowork<br/>to analyze files]
  B --> C{VM network<br/>allowlist}
  C -->|blocked| X[most domains]
  C -->|allowed| D[Anthropic file-upload API]
  D --> E[File in attacker's account]

Preconditions / Affected

Cowork connected to a local folder with sensitive files, plus any untrusted content entering the model's context. The injection source is not limited to the uploaded file — the page names web data via Claude for Chrome and connected MCP servers as equivalent vectors. No human approval step is triggered at any point. Demonstrated against Claude Haiku; also succeeded against the more injection-resistant Opus 4.5 in a developer-context variant (a malicious "integration guide").

What to do

The page offers no patch — the underlying issue is unremediated. Practical exposure reduction from the text:

• Do not grant Cowork access to local folders containing sensitive information (Anthropic's own stated onus on users, which the article criticizes as unrealistic for non-technical users).
• Treat Connectors (browser, MCP, AppleScript) as a major risk surface and configure them cautiously — each expands the "agentic blast radius" where untrusted and sensitive data mix.
• Do not rely on spotting "suspicious actions" as a control; the font-hiding technique defeats manual review.

Caveats

The DoS finding is unconfirmed as an exploit: PromptArmor only "posits" that a malformed file (e.g., a text file named .pdf) triggering persistent API errors could be weaponized via injection to create-then-read such a file. The Opus 4.5 success was in a developer scenario, not the everyday-user chain that was the article's focus.