Living off the AI: Claude memory stores carry an attacker's orders

01What happened

Darktrace Signal Labs published a lab demonstration on 12 November 2026 in which Claude Code agents on a compromised machine were tasked in near real time through Claude's memory stores feature. Moishe Tajtelbaum and Sam Lister report that the technique was not seen in the wild and does not rely on a flaw in the Claude platform. Anthropic is not affiliated with the research and has not endorsed it.

02How it works

Three files in a memory store added to the victim's Claude Console workspace do the work: a heartbeat file where each agent harness process checks in, an input file where the operator queues jobs written in plain language, and an output file where the agent posts results. A hook sends the check-in, then a non-interactive Claude Sonnet 4.5 session reads the queued job and carries it out through bash tool calls. A transient systemd service keeps spawning harness processes so the channel survives. Because the traffic goes to the same API endpoint as ordinary inference, it sits alongside legitimate use.

03Who is affected

Organizations where developers run Claude Code and hold Claude Console credentials are the exposed group. The attacker needs the preconditions listed below, so no product version is at fault: the chain strings together documented platform features.

04What to do

Correlate process creation with the network activity of agent harness processes, and baseline that behavior so deviations stand out, such as tool calls with unusual command-line arguments or an unusual ratio of data sent to the AI platform's API. Darktrace notes that signatures do not help here, because the traffic looks like legitimate API use.

Questions people ask

Is Claude Code vulnerable to the Darktrace memory store C2 technique?

Darktrace states that the memory store command-and-control chain does not rely on a vulnerability in the Claude platform. The technique strings together documented features: memory stores, hooks, bash tool calls and the Files API. An attacker must already hold a foothold on the device and the user's Claude Console credentials, so the exposure comes from credential theft rather than a product flaw.

What did the Darktrace agent do once it was tasked?

Nine jobs were dispatched to the Claude Code agent inside Darktrace's simulated Active Directory network. The agent ran network and service discovery, nmap scanning and anonymous FTP enumeration that exposed employee details and a password, built a 190-entry username list, sprayed passwords against the domain controller to find a valid account, enumerated SMB shares, and retrieved a 1 GB file.

How can defenders detect agent harness traffic used as C2?

Behavioral analysis is the detection route Darktrace recommends, because the channel reaches the same Claude API endpoint as legitimate inference and carries no distinguishing signature. Darktrace suggests correlating process creation with the network activity of agent harness processes, then baselining that behavior to flag tool calls with unusual command-line arguments and unusual ratios of data sent to the platform's API.

Sources 2 links, all fetched

1. 1darktrace.comDarktrace Research
2. 2platform.claude.comClaude Memory Docs