Darktrace Lab Test: Claude Memory Works as Covert Command Channel

By Olivia Hart

Darktrace’s Signal Labs ran nine tasks in a laboratory test that used Claude memory files as a live command-and-control channel. The sequence included password spraying and the exfiltration of a 1 GB file.

The test required an attacker already controlling a device and holding valid Claude Console credentials. Darktrace said the method “has not been observed in the wild,” making it a controlled demonstration of post-compromise risk rather than evidence of an active campaign.

What did Darktrace’s lab test show?

Darktrace’s Signal Labs published Living off the AI: Shared Memories as a Covert C2 Channel. Its researchers simulated a corporate Active Directory environment with a Linux device running an internal Claude Code agent harness.

After gaining initial access and collecting the user’s Claude Console API credentials through a shell payload, the researchers added three files to the user’s Claude workspace through the Claude API. The files—a heartbeat file, an input file for instructions and an output file for results—formed the memory store.

A transient systemd service repeatedly spawned Claude Code harness processes. Each checked the heartbeat file, pulled a natural-language task from the input file, used the model’s tool-calling capabilities and posted results to the output file.

The operator monitored that output and updated the input with new tasks, creating an interactive feedback loop through channels native to the agent’s normal operation. The core result is simple: a lab operator instructed a Claude Code agent on a compromised device through files the platform treats as routine memory.

Which tasks did the agent complete?

Darktrace counted the demonstration as nine tasks. Its published list included:

• Network reconnaissance and service enumeration.
• FTP credential harvesting, username-list generation and password spraying.
• SMB share enumeration in two steps.
• Downloading, splitting and exfiltrating a 1 GB file through the Claude Files API.

The run moved from discovery to credential abuse and data movement inside a simulated corporate environment. The test covered a sustained intrusion workflow, not a one-off prompt.

What are the limits on the finding?

Darktrace set three central limits on the claim. The technique requires prior device compromise and valid Claude Console credentials, so it cannot give an attacker an initial foothold. It also repurposes legitimate Claude features and does not exploit a vulnerability in the platform.

The German security outlet aifence.de confirmed the laboratory-only character and reported that Darktrace performed no comparative testing against other agent platforms. Darktrace itself did not establish how common Claude Code deployments are in enterprises, how widely the memory stores feature is used or how readily attackers can obtain valid Claude Console credentials in real intrusions.

It also left GitHub Copilot, Cursor and similar platforms untested. The practical conclusion is narrow: the lab proved a possible chain of actions, not that attackers are using it.

How can defenders detect the activity?

Darktrace said the C2 traffic uses the same Claude API endpoint as normal inference, making traditional network signatures ineffective. Its proposed method correlates process creation and network traffic from agent harness processes against behavioral baselines.

Darktrace recommends flagging unusual command-line arguments, atypical data-transfer ratios and agent processes accessing internal resources outside their documented workflow. The guidance is tied to Darktrace’s own behavioral analytics product, which limits how far the source supports vendor-neutral claims about detection.

A familiar endpoint can conceal an unfamiliar process pattern, so visibility depends on behavior rather than the API address alone.

What does the finding mean for enterprise AI security?

Darktrace frames the research as an extension of “living off the land” into enterprise AI agents. The lab configured the local agent to treat writable memory contents as executable task queues, effectively turning a knowledge store into an administration interface.

Anthropic’s documentation separately warns that manipulated inputs in writable memory stores can persist harmful content. It recommends read-only access for reference material, a safeguard Darktrace’s experiment did not use.

Darktrace cited earlier reporting on the credential stealers QUIETVAULT, s1ngularity, SANDWORM_MODE and DUSTMAKER. According to Darktrace, those tools offloaded collection tasks to AI agents on infected devices but lacked the interactive feedback loop shown in the test.

Darktrace said the memory-store technique showed how that loop could work without a separate malware implant. The novelty is not stolen agent access; it is a repeatable command channel built from expected agent plumbing.

Darktrace’s research leaves the decisive questions open: how widely Claude Code and memory stores are used in enterprises, how attackers obtain valid credentials and whether the method works on other platforms. Until production evidence resolves those gaps, the defensible conclusion is narrow: compromised Claude credentials plus writable memory supported a covert, interactive C2 workflow in a lab.