Claude Cowork File Exfiltration: Prompt Injection Attack

An allowlist built to stop this, with one entry that undoes it

Cowork defaults to allowing outbound HTTP traffic to only a specific list of domains, meant to protect a user against prompt injection attacks that try to exfiltrate their data by having the agent send it somewhere on the open internet. [1]

Anthropic's own API is on that allowlist, because Cowork itself needs to reach it to function. PromptArmor built an attack around exactly that entry: a prompt injection that supplies an attacker's own Anthropic API key and instructs the agent to upload every file it can see to the api.anthropic.com files endpoint using that key. The traffic never leaves the allowlist, so the restriction that is supposed to stop exfiltration has nothing to object to. [1][2]

Atlas interpretation: The allowlist restricts destinations, not who controls the account being written to at an allowed destination. An attacker's own credentials, passed through the same channel as everything else in the request, turn a trusted domain into a private mailbox. [1][2]

A hidden document, a file upload, no one asked

PromptArmor's proof of concept connects Cowork to a local folder holding confidential files, then has the victim ask the agent to review a document that carries the injected instructions hidden in white on white, minimal size text. Processing that document triggers a curl command that uploads the visible files to the attacker's account, and the attacker then downloads them from their own Anthropic files endpoint. [2]

PromptArmor states plainly that at no point in this process is human approval required. [2]

PromptArmor's report also notes that Johann Rehberger had previously found and disclosed a version of this problem in Claude.ai chat, and says it was acknowledged but not remediated. [2]

Atlas interpretation: PromptArmor published two days after Cowork shipped, which is a short enough gap that the underlying weakness, an allowlisted first party endpoint doubling as an exfiltration channel once an attacker's own key is in play, reads as inherited rather than newly introduced by Cowork. Whether Anthropic fixed the allowlist, added an approval step, or did something else after this report is outside what these two sources establish. [1][2]