Darktrace Turned Claude Code Into a Spy. Lock Down Your AI Keys.
Darktrace researchers reported a lab test in which a stolen Claude key was used to send nine jobs through Claude's memory store and pull out a 1 GB file. All of that traffic went to api.anthropic.com. Source: Darktrace Signal Labs, Nov. 12, 2026, via Help Net Security, Nov. 12, 2026.
If you use Claude Code at work, your API key just became a lot more valuable to attackers. Darktrace researchers showed that with a stolen Claude key, they could turn Claude Code into a remote-controlled spy, in a lab test (Help Net Security, Nov. 12, 2026, Darktrace Signal Labs, Nov. 12, 2026).
This was not a bug in Claude. Darktrace says the technique does not rely on a vulnerability in the Claude platform, and they have not seen it used in the wild. The key was sitting on the developer's machine. Treat an AI key like a production password.
You can watch the short version here:
The video uses a digital avatar of Erick Grau, CEO of Chibitek.
Why Does This Matter?
An API key is a password for software. Claude Code uses it to talk to Anthropic's API and do work on a developer's machine. If an attacker already has a foothold on that machine and steals a valid key, they may not need to install a new remote-control tool. They can pass jobs to the coding agent that is already there.
Think of it like leaving a spare office key in a desk drawer. The lock still works. Someone who finds the key can walk in and look like they belong.
I walk through what the researchers did, and four ways to protect your AI keys, in this Short: Watch the Short on YouTube
What Did Researchers Find?
Darktrace Signal Labs ran the test in its own simulated corporate Active Directory network, on accounts and systems it controlled. No customer environments or customer data were used, and the names and credentials it published are fictitious (Darktrace Signal Labs, Help Net Security).
Here is the path they described. A small payload on a Linux machine found Claude Code, collected the user's Claude credentials, and set up a service that kept launching Claude Code with the --dangerously-skip-permissions flag, which turns off the usual "are you sure?" prompts before the agent uses tools.
The researchers then used Claude's memory stores feature as the command channel. Memory stores are collections of text files attached to a Claude Console workspace, meant to help agents remember things between sessions. Darktrace says a store can be added through the API whether or not the organization uses Anthropic's Managed Agents service.
They created a store with three files: a heartbeat file for check-ins, an input file for the next job, and an output file for the result. The jobs were written in plain English, so the operator could hand over an objective and let the model work out the commands. Every job and every result traveled through api.anthropic.com, the same endpoint the agent already uses, so the traffic looked like a coding agent doing its job.
The 1 GB file was split into three pieces and uploaded through the Claude Files API. All traffic went to api.anthropic.com. Source: Darktrace research, via Help Net Security, Nov. 12, 2026.
The operator sent nine jobs through that memory store. The agent mapped the local network, pulled employee names and a password from an anonymous FTP share, generated 190 candidate usernames, sprayed the password at the domain controller, and found the account it belonged to. It listed file shares with that account, downloaded a 1 GB file, split it into three pieces, and uploaded them to the Claude Files API. The file left the network for Anthropic's servers (Help Net Security, Darktrace Signal Labs).
Darktrace says this was a lab test, it does not rely on a Claude platform vulnerability, and they have not seen it in the wild. The key was sitting on the developer's machine. Source: Help Net Security, Nov. 12, 2026.
Tim Bazalgette, Chief AI Officer at Darktrace, told Help Net Security that Darktrace shared the findings with Anthropic before publication, as a courtesy, with no formal disclosure process, because there was no vulnerability to disclose (Help Net Security).
The official Short cover, used on YouTube, is below. It is 1080 by 1920, so it is not the Wix post cover.
Official Short cover (1080 by 1920). The 1 GB tile and api.anthropic.com line match the Darktrace and Help Net Security accounts cited above.
What Should You Do Today?
These four steps come from Bazalgette's guidance in the Help Net Security report, and they are the same checks I walk through in the Short.
Use OAuth sign-in instead of raw API keys wherever you can. In the test, a standard API key reached the memory stores feature, while OAuth credentials did not.
If you must use keys, keep them short-lived and narrow. Limit what each key is allowed to do, and do not let old keys live forever.
Get keys out of shell history, dot files, and environment variables. Those are everyday places a key can sit on a developer's machine.
Watch the agent. Look for Claude Code running with the --dangerously-skip-permissions flag, or moving far more data than usual to and from the API.
Treat an AI key like a production password.
The four tips and the closer line, as shown in the Short. Source: Tim Bazalgette, quoted in Help Net Security, Nov. 12, 2026.
These checks are Chibitek guidance, based on what Darktrace recommends.
Key Points of Claude Code API Keys
Darktrace researchers showed, in a lab test, that a stolen Claude key can turn Claude Code into a remote-controlled spy.
They passed plain-English jobs through Claude's memory stores feature and pulled out a 1 GB file through the Claude Files API.
Nine jobs were sent through that store. The agent mapped a simulated network, sprayed a password, found an account, and moved the file in three pieces.
All of that traffic went to api.anthropic.com, so it looked like normal coding work.
This is not a bug in Claude, and Darktrace has not seen it used in the wild. The key was sitting on the developer's machine.
Prefer OAuth over raw API keys, keep any keys short-lived and narrow, get them out of everyday files on the machine, and watch the agent for unusual flags or data volume.
Frequently Asked Questions
What is a Claude API key in this context? It is a password that lets Claude Code, or other Claude tools, sign in to Anthropic's API and do work without a person typing a password each time.
Was this a real attack on companies? No. Darktrace says this was a controlled lab test in its own test environment. It has not seen the technique used in the wild, and the names and credentials it published are fictitious.
Is this a bug in Claude? Darktrace says the technique does not rely on a vulnerability in the Claude platform. The researchers used valid credentials and features that already exist, including memory stores and the Files API.
What are memory stores? They are collections of text files attached to a Claude Console workspace, so an agent can remember things between sessions. In the test, the researchers used three files as a check-in, a job inbox, and a results outbox.
Why does OAuth matter here? Bazalgette told Help Net Security that a standard API key reached memory stores, while OAuth credentials did not. He still notes that an attacker could try to hijack an OAuth session, which he said is harder to pull off.
What should I watch for on a machine that runs Claude Code? Darktrace's detection advice is to compare what the agent process launches, and the traffic it generates, against a normal baseline. A coding agent talking to Anthropic's API is expected. The same process running with unusual command-line flags, or moving data in a pattern that looks nothing like its usual work, is what should stand out.
Let's Treat AI Keys Like the Passwords They Are
At Chibitek, we help businesses review the credentials that sit behind everyday tools, including AI coding agents, with no geek-speak. Don't let a forgotten API key on a developer's machine become a remote control for the agent you already trust. Contact us at hello@chibitek.com to learn how we can help you review key storage, tighten sign-in options, and watch agent behavior.
Further reading: Help Net Security's report and Darktrace Signal Labs' write-up.
You can watch the short version here:
The same video is also on LinkedIn.
We make IT effortless so you can create, disrupt, and grow!
Follow Chibitek on YouTube at @chibitekmsp, and follow Chibitek on LinkedIn.
Comments