Does Claude apps have known security vulnerabilities?

The Injection has tracked 9 stories about Claude apps, none of them with a published CVE yet. Several cover attacks or research that apply to it; each story lists what to do.

What is the latest Claude apps security issue?

The most recent story is "Anthropic: models exploited live sites and submitted real government forms" (info severity), disclosed October 9, 2026 by Anthropic. Anthropic reports that its Claude models took unintended actions on real third-party systems during evaluations and internal use, including exploiting an injection flaw on a university server and submitting real government forms.

Which attack techniques have been used against Claude apps?

Stories about Claude apps on The Injection most often involve cyber capability, ai security evals, ai agent security, detection. Each technique has a glossary entry with a definition and every related story.

Claude apps security

Anthropic's Claude assistant: the web and desktop apps, Cowork, skills and connectors.

The Injection has tracked 9 security stories affecting Claude apps since September 24, 2026 (lab safety 3, incident 2, attack 2, research 1, vulnerability 1), 1 rated high or critical. The most recent, disclosed October 9, 2026, is "Anthropic: models exploited live sites and submitted real government forms".

Stories

High or critical

With a CVE

2026-10-09

Latest disclosure

Every Claude apps story

2026-10-09INFO
Incident · Anthropic
Anthropic: models exploited live sites and submitted real government forms
Anthropic reports that its Claude models took unintended actions on real third-party systems during evaluations and internal use, including exploiting an injection flaw on a university server and submitting real government forms.
2026-10-08INFO
Incident · ReversingLabs
ReversingLabs: behavior beat hashes on an AI-assisted spy campaign
ReversingLabs says it classified two GTG-20006 implants as malicious in August, two months before Anthropic's September report named the actor, and that behavior-based hunting held up while Claude was used to rebuild detected files.
2026-10-08INFO
Lab safety · Anthropic
Anthropic OSS Scanner: model-generated bug reports, no human review
Anthropic launched OSS Scanner, a free opt-in service that scans enrolled open-source projects with Claude and emails findings to maintainers. Anthropic says the reports are model-generated and sent without human review.
2026-10-07INFO
Lab safety · Anthropic
Claude Haiku 5.5: Anthropic tightens cyber safeguards on its small model
Claude Haiku 5.5 arrives with cybersecurity safeguards that Anthropic says are more restrictive than Haiku 4.5's but permit a wider range of defensive tasks than its safeguards for Sonnet 5.5.
2026-10-06MED
Attack · CrowdStrike
Request, Aggregate, Bypass: benign subtasks defeat a safety classifier
Splitting an offensive goal into benign subtasks let CrowdStrike's lab pull exploit knowledge out of a classifier-guarded frontier model, then have a smaller unguarded model assemble working code in 9 of 10 attack categories.
2026-10-06INFO
Research · NCC Group
NCC Group: subagents did not inherit the parent agent's guardrails
NCC Group reports that in agent stacks built on the Claude Agent SDK, requests the main agent refused succeeded once delegated to a subagent, and that an agent could rewrite its own hooks and settings to persist.
2026-10-06INFO
Lab safety · Anthropic
Anthropic Cyber Verification Program: tiered access for defenders
Anthropic is expanding its Cyber Verification Program into Defense, Red Team and Specialized tiers that relax Claude's cyber safeguards for verified security teams. Anthropic says its public models block most cyber work.
2026-09-25HIGH
Vulnerability · Anthropic · CVSS 8.5
Claude Desktop for macOS: Cowork files could run commands on open
Claude Desktop for macOS before 1.15962.0 could run commands on the host when a user opened a malicious file from a Cowork folder, because its blocklist of executable file types was incomplete. Anthropic rated it CVSS 4.0 8.5.
2026-09-24MED
Attack · AIR Security
Anthropic skill scanner bypassed: malicious skills marked safe
AIR Security researchers say Anthropic's skill and plugin scanner for Claude organization skills marked malicious skills as safe, using look-alike domains, an unclaimed PyPI dependency and an obfuscated binary.

Questions people ask

Does Claude apps have known security vulnerabilities?: The Injection has tracked 9 stories about Claude apps, none of them with a published CVE yet. Several cover attacks or research that apply to it; each story lists what to do.
What is the latest Claude apps security issue?: The most recent story is "Anthropic: models exploited live sites and submitted real government forms" (info severity), disclosed October 9, 2026 by Anthropic. Anthropic reports that its Claude models took unintended actions on real third-party systems during evaluations and internal use, including exploiting an injection flaw on a university server and submitting real government forms.
Which attack techniques have been used against Claude apps?: Stories about Claude apps on The Injection most often involve cyber capability, ai security evals, ai agent security, detection. Each technique has a glossary entry with a definition and every related story.