Incident·WS-0070·Jan 14, 2026·in the wild·AI security flaws

Claude Cowork can be tricked into uploading users' files

Anthropic Claude Cowork (research preview)

23/100

WS-2 Moderate

Harm score 5, signal score 46. Autonomy: acted (the AI took a bounded action). How the scores work.

Harm 0/5

damage actually done

Reach 1/5

who was affected

Autonomy 2/4

how much the AI did on its own

Novelty 2/5

how new the behavior was

Permanence 0/5

how hard it is to undo

Days after Claude Cowork launched, PromptArmor showed that a hidden prompt injection could make the agent upload a user's local files to an attacker's Anthropic account. The attack worked because Anthropic's API domain was on Cowork's outbound network allowlist. Per the researchers, Anthropic acknowledged the issue and warned users about the preview's risks rather than shipping an immediate fix.

Damage

none realized (demonstrated vulnerability)

The capability behind it

Claude 3.5 Sonnet operates a computer from screenshots: OSWorld 14.9%Oct 22, 2024 · Anthropic · reliable for a defined task: partial

Sources

PromptArmor, second source. Johann Rehberger had earlier disclosed the same exfiltration path in Claude.ai. The date is the date of public write-up and coverage.

Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.