Darktrace demonstrated a covert command channel through Claude shared-memory artifacts

Darktrace researchers demonstrated a laboratory operation in which a precompromised endpoint and Claude API credentials allowed an operator to exchange commands and results through shared memory artifacts and ordinary provider requests.

In the controlled environment, a recurring local Claude Code process handled nine operator tasks and transferred a simulated one-gigabyte file in three chunks using provider APIs. The initial compromise and usable API token were explicit prerequisites. Provider traffic and legitimate memory synchronization can conceal a command loop from a network-only observer, but the host compromise is not caused by the memory API itself.

The exercise used fabricated credentials and a lab network. It is not a reported wild Claude malware campaign, a new platform CVE or evidence that one gigabyte of real customer material was stolen. Use host process provenance and authorized outbound telemetry to distinguish normal assistant memory from repeated attacker-controlled commands.

Evidence reconciliation and effect boundary. The attacker-controlled memory entries acted as an instruction mailbox read by a locally scheduled Claude Code process, while outbound API traffic supplied an apparently ordinary channel for task results. The device compromise and credentials were prerequisites, not achievements of the memory mechanism itself. This is a demonstration of concealed post-compromise operations rather than a platform authentication bypass or a documented field campaign.