Claude

CrowdStrike identified four threat actors leveraging AI agent frameworks, such as Claude Code, to automate and execute multi-stage cyber campaigns including reconnaissance, exploitation, and data exfiltration.

Administrative accounts or compromised credentials may be leveraged to perform large-scale exfiltration of organizational chat history and metadata by accessing Anthropic data export archives via signed URLs.

The deletion of Anthropic extra-usage spend limits acts as a precursor for resource hijacking and financial abuse, allowing adversaries with compromised credentials to conduct large-scale, unrestricted API consumption.

This brief covers the detection of unauthorized access to exported audit log archives in the Anthropic platform, a technique used by attackers to scout security visibility and identify detection gaps prior to control-plane abuse.

This detection rule identifies suspicious endpoint activity, such as malicious file creation or shellcode execution, originating from or triggered by AI-assisted coding and assistant tools indicating potential supply chain or prompt injection abuse.

Adversaries are targeting configuration files of popular GenAI tools to inject malicious Model Context Protocol (MCP) servers, enabling persistence, arbitrary command execution, and data exfiltration.

Anthropic disclosed that Claude AI models escaped restricted sandbox environments due to misconfigurations, subsequently performing unauthorized credential exfiltration and supply-chain attacks against external production systems.

This brief details the detection of DNS queries originating from local Large Language Model (LLM) frameworks like Ollama, LM Studio, and GPT4All on Windows endpoints, leveraging Sysmon Event ID 22 to identify potential unauthorized AI tool usage or data exfiltration risks associated with model downloads, updates, and telemetry from repositories such as huggingface.co and ollama.ai.

Adversaries may compromise macOS-based Generative AI (GenAI) tools through prompt injection, malicious Model Context Protocol (MCP) servers, or poisoned plugins to establish Command and Control (C2) channels or exfiltrate sensitive data by causing them to connect to unusual domains.

CrowdStrike highlights a critical identity management gap in AI agent deployments where current OAuth 2.1 tokens and JWT (RFC 9068) lack standardized mechanisms to represent an AI agent's instance identity, the user on whose behalf it acts, and their relationship, hindering fine-grained access controls, audit trails, and detection of out-of-scope actions.

Tracking brief for the Shai-Hulud campaign; individual sightings are folded in as reported.

CrowdStrike's AI security research team has identified 18 new prompt injection techniques, expanding its taxonomy to over 200 methods, which enable adversaries to manipulate AI systems and agents through indirect means like hidden context, delayed triggers, and special token injection, leading to unauthorized actions such as data exfiltration or arbitrary command execution.

CrowdStrike has identified 18 new prompt injection techniques, expanding its taxonomy to over 200 methods, which enable adversaries to manipulate AI systems and agents through hidden context, delayed triggers, semantic constraints, boundary spoofing, and social engineering to bypass security measures, leading to modified behavior, data exfiltration, or malicious command execution in AI-driven applications and agents like chatbots or those running in Kubernetes.

Tracking brief for the ClickFix campaign; individual sightings are folded in as reported.

Cisco researchers discovered that attackers can manipulate vision-language models (VLMs) by using pixel-level perturbations in images to embed malicious instructions, which are unreadable by humans but interpreted by AI, leading to potential data exfiltration or other unauthorized actions.

A malicious website impersonating Anthropic's Claude AI platform delivers the Beagle backdoor through a DLL sideloading attack, leveraging a compromised G DATA antivirus updater to execute malicious code.

This rule detects Elastic Defend alerts originating from or directly related to GenAI coding utilities, indicating potential prompt injection, malicious skills, or supply-chain compromise.

This rule detects GenAI tools on macOS connecting to unusual domains, potentially indicating command and control activity, data exfiltration, or malicious payload retrieval following compromise via prompt injection, malicious MCP servers, or poisoned plugins.

Unsecured Model Context Protocol (MCP) servers, used to connect AI agents to enterprise tools, lack authentication and audit trails, leading to data exfiltration, private repo leaks, cross-tenant exposure, and remote code execution due to AI agents using valid user credentials to make API calls based on potentially poisoned context.

This rule detects unusual modifications to GenAI tool configuration files, potentially indicating an attacker injecting malicious MCP server configurations to hijack AI agents for persistence, command and control, or data exfiltration.