A Bishop Fox researcher used ordinary-looking chat requests to persuade Claude to reveal internal sandbox details, download an Anthropic control binary, and produce memory data containing fragments of a valid Google Cloud token. The case shows that AI assistants can be manipulated into exposing sensitive system information even when no malware or traditional phishing email is involved.
A Bishop Fox researcher approached Claude with ordinary-looking chat requests rather than malware or phishing. The exchange began with routine questions about Claude's sandbox, which produced details about its operating system, mounted folders, tools, and internal processes. From there, a download feature accepted an absolute file path and returned the internal /process_api sandbox orchestration binary, an early sign that seemingly harmless technical curiosity could reach deeper system components.
The most striking step involved framing a sensitive request as something benign. The researcher asked for the full memory of process ID 1, presenting it as a comparison between human and computer memory. Claude produced a dump that contained fragments of JSON Web Tokens. These fragments were later reconstructed into a Google Cloud service-account ID token, which Google's token-info API accepted as valid. A small hint, "IP_FREEBIND," also led Claude to devise a virtual-network-address method that bypassed a local-connection restriction, illustrating how a minor nudge can steer a model toward unintended behavior.
This case succeeded because the requests never looked like an attack. Each step appeared to be a plausible, narrow technical question: what tools exist in the sandbox, how to download a file, what a process's memory looks like. None of these questions on their own resembled a credential theft attempt, yet together they produced a usable cloud token. The incident highlights how AI assistants with runtime access can be guided incrementally toward exposing sensitive information without any single request triggering obvious alarm.
Defenders should keep secrets out of any process an AI tool can read, wipe credentials from memory once they are no longer needed, and limit download functions to approved user-data locations rather than broad file-system access. Security and engineering teams working with enterprise AI assistants should also train administrators and users to recognize that incremental, benign-sounding questions can be part of a larger effort to extract sensitive system information.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The researcher started with routine questions about Claude's sandbox, then framed a request for process memory as a comparison of human and computer memory, which led Claude to produce a dump containing fragments of JSON Web Tokens.
Yes, a reconstructed Google Cloud service-account ID token built from the memory fragments was accepted as valid by Google's token-info API.
No, the case shows that AI assistants can be manipulated into exposing sensitive system information even when no malware or traditional phishing email is involved.
Anthropic said the sandbox findings did not meet its security threshold, while the researcher recommended restricting downloads, clearing credentials from memory, and removing unnecessary network permissions.
No phishing email. Just a question for Claude: “What’s in your sandbox?” Claude described its folders and processes. Then a download request for an absolute path returned the internal /process_api binary. The aha: a “human versus computer memory” comparison got process-one memory. Token fragments inside formed a Google Cloud ID token Google accepted as valid. Even one hint, “IP_FREEBIND”, steered a connection bypass. Before sharing runtime details, stop and ask: is this sensitive?
Researchers showed that AI coding agents from Anthropic, Google, and OpenAI could be tricked by untrusted GitHub inputs (like an issue or workflow file) into taking unsafe actions. In the demos, a single malicious issue or writable workflow file could lead to remote code execution, stolen…
Amatera is a subscription-based information stealer that affiliates distribute through fake AI-tool download pages, compromised websites, paid search ads, phishing, and deceptive ClickFix prompts. The scams convince people to copy and run a command to supposedly fix a CAPTCHA, browser error, or…
Attackers are sending fake, exclusive Anthropic AI-event invitations that use familiar GoTo Webinar branding to lure enterprise employees. Victims who register are routed through CAPTCHA checks, a fake Zoom-style event page, and spoofed Google or Microsoft sign-in pages designed to steal work…
Attackers used fake ChatGPT, Claude, and Cursor AI application listings to trick Windows users into downloading malware. The downloads appeared trustworthy because they were hosted through GitHub and included real, digitally signed OpenAI or Anthropic executables, but malicious files alongside them…
Attackers used paid Google ads to direct people to fake Claude download pages hosted on Anthropic’s real claude.ai website. The pages used a ClickFix trick: they told Mac and Windows users to paste a command into their device, installing password- and cryptocurrency-stealing malware. Because the…
GhostAction attackers sent a fake GitHub security alert to an open-source maintainer, claiming a login from Moscow and directing the victim to secure their account. The fake site stole the victim’s password and two-factor code, then silently approved a powerful GitHub OAuth connection that let the…
