AI security: how a Word document made Anthropic's Claude exfiltrate confidential files

That .docx you just uploaded to your AI assistant may have forwarded your files to somebody else.

What happened in January

Everyone is nervous about installing an autonomous agent on their laptop. A security nightmare, they say. Meanwhile the chatbot they already trust shipped with a vulnerability that let it silently upload user files to an attacker, and the vendor knew about it before launch.

The timeline is January 2026. A hidden prompt injection inside an ordinary-looking Word document caused Claude Cowork to upload confidential files to an attacker-controlled account. No permission dialogue. No visible action. Johann Rehberger, a red-team director who has spent years documenting this class of attack, reported it to Anthropic three months before the product shipped.

Why the outbound block did not help

The mechanism is almost elegant. The agent blocks outbound traffic to most domains, but the vendor's own API endpoint is whitelisted; it has to be, since the product runs on it. So the attacker embeds their own API key in the injection. The agent then does exactly what it was designed to do: it calls a trusted endpoint. The files land in someone else's account.

Which question this actually changes

Was it fixed? The specific exploit was patched. But the underlying technique has no complete solution. OpenAI has stated that prompt injection is unlikely ever to be fully solved. The UK National Cyber Security Centre has said it may never be totally mitigated.

Which reframes the question. It is not "should I install an autonomous agent". The assistant you already use may be sending your documents somewhere right now, and the architecture that permits it is the same in both cases.