How a Word document can hack Claude

The real danger of a hidden prompt injection

The chatbot you already trust - the white-collar world's sweetheart, Claude - has a vulnerability that lets it upload users' files to hackers.

In January 2026, researchers showed that a hidden prompt injection inside a normal-looking Word document (.DOCX) could make Claude Cowork upload confidential files to an attacker's Anthropic account¹, absolutely silently and without a permissions popup.

Johann Rehberger (Red Team Director at Electronic Arts, ex-Microsoft) reported it to Anthropic 3 months before launch².

The attack is almost elegant: Claude Cowork blocks suspicious traffic to most domains, but Anthropic's own API is whitelisted, so the attacker embeds their API key in the injection.

Malicious content planted inside data and documents, or backdoors in a model, can exploit this to exfiltrate private information.

Has it been fixed? Anthropic patched that exploit. Prompt injection itself still has no complete solution³.

OpenAI, for example, admits it "is unlikely to ever be fully solved"⁵. The UK National Cyber Security Centre says the same.

As there is no inherent distinction between 'data' and 'instruction', it's very possible that prompt injection attacks may never be totally mitigated in the way that SQL injection attacks can be.⁶