Evidence · DiggingBeagle record
Darktrace: shared agent memories as a covert command channel
Primary or origin disclosure used to qualify the underlying mechanism, stated prerequisites and limits. Initial attacker endpoint compromise and Claude API credentials; attacker creates shared heartbeat/input/output memory files; transient systemd runs Claude Code process repeatedly, reading commands and reporting results via legitimate Anthropic APIs. Nine jobs including network discovery, FTP/SMB/SSH enumeration, credentials and 1GB sample file in three Files API chunks.
- Source role
- primary disclosure
Evidence record
Primary or origin disclosure used to qualify the underlying mechanism, stated prerequisites and limits. Initial attacker endpoint compromise and Claude API credentials; attacker creates shared heartbeat/input/output memory files; transient systemd runs Claude Code process repeatedly, reading commands and reporting results via legitimate Anthropic APIs. Nine jobs including network discovery, FTP/SMB/SSH enumeration, credentials and 1GB sample file in three Files API chunks.
Claim-level citations (3)
- supportsDarktrace demonstrated a covert command channel through Claude shared-memory artifacts: Darktrace established its Claude memory-channel experiment only after assuming an already compromised endpoint and Claude credentials; the controlled exercise issued nine operator tasks and transferred a synthetic 1 GB file in three chunks.
Darktrace Signal Labs, laboratory setup, command task list and file-transfer demonstration
- supportsDarktrace demonstrated a covert command channel through Claude shared-memory artifacts: The exercise used fabricated credentials and a lab network. It is not a reported wild Claude malware campaign, a new platform CVE or evidence that one gigabyte of real customer material was stolen.
Controlled experiment, initial foothold, nine tasks, file-transfer demonstration and limitations
- supportsDarktrace demonstrated a covert command channel through Claude shared-memory artifacts: Darktrace researchers demonstrated a laboratory operation in which a precompromised endpoint and Claude API credentials allowed an operator to exchange commands and results through shared memory artifacts and ordinary provider requests.
Controlled experiment, initial foothold, nine tasks, file-transfer demonstration and limitations