Thursday, October 8, 2026 · Week 41 Reading for Oct. 8 · Last entry Oct. 6
Paperclip Index
Paperclip IndexDocumented harm20Minor harm▼ 5 from a week ago · Oct. 8The Index

Hijacked by injectionPI-0038

Hidden text in a document made Anthropic's Claude Cowork upload user files to an attacker's account

Days after Anthropic launched Cowork, PromptArmor showed that a document with near-invisible instructions could make the agent upload files from a folder the user had connected to an attacker's Anthropic account, using Anthropic's own allow-listed API domain. Johann Rehberger had reported the same Files API exfiltration path in Claude.ai to Anthropic in October 2025, and it was not fixed before Cowork launched, according to reports.

Reported Jan. 14, 2026Happened in January 2026Updated Oct. 6, 2026Rated under methodology v0.6

Control failure, trackedNot counted. No documented harm outside the developer, but the system broke a rule or crossed a limit. Tracked beside the index.
Harm
Harm: No harm reportedAdds nothing to the index.
Control
Control level 2, Instruction violationReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Controlled testSingle sourceInitiated by Outside attacker
Near miss

Near miss. Harm was plausible but prevented. It is rated only on what actually happened.

Not counted: no harm reportedEffect on the index

Sources

How we know

5 sources · single source. Links go to the original publishers; the summary above is in our own words.

  1. researchClaude Cowork Exfiltrates FilesPromptArmor · Jan. 14, 2026promptarmor.com/resources/claude-cowork-exfiltrates-files
  2. researchClaude Pirate: Abusing Anthropic's File API For Data ExfiltrationEmbrace The Red (Johann Rehberger) · Oct. 28, 2025embracethered.com/blog/posts/2025/claude-abusing-network-access-and-anthropic-a…
  3. newsContagious Claude Code bug Anthropic ignored promptly spreads to CoworkThe Register · Jan. 15, 2026theregister.com/2026/01/15/anthropics_claude_bug_cowork/
  4. newsClaude Cowork hit with file-stealing prompt injection days after Anthropic's launchThe Decoder · Jan. 17, 2026the-decoder.com/claude-cowork-hit-with-file-stealing-prompt-injection-days-afte…
  5. blogClaude Cowork exfiltrates files (link post)Simon Willison's Weblog · Jan. 14, 2026simonwillison.net/2026/Jan/14/claude-cowork-exfiltrates-files

Why this rating

No harm reported; control failure level 2

Two separate assessments. Only documented harm can count toward the index.

Observed harm

No harm reported

Researcher demonstration on controlled accounts; no victims reported.

Not a finding that no harm occurred.

The harm scale
  1. 1 Negligible Inconvenience, easily remedied.
  2. 2 Minor Limited, recoverable harm.
  3. 3 Moderate Material harm needing significant effort to remedy.
  4. 4 Severe Severe harm to health, rights, property or essential services.
  5. 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.

Control assessment

Instruction violation

The agent used network access and files it had been granted, on injected instructions.

Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.

The control scale
  1. 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
  2. 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
  3. 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
  4. 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
  5. 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.

Rating rationale

No external harm was reported from this controlled test. Control remains level 2. No Anthropic confirmation of this test appeared in the sources reviewed.

The scales

Effect on the index

It does not count toward the Jan. 19 reading

The reading for the week to Jan. 19, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.

Not counted: no harm reported. 3 other records behind the reading for that week.

The arithmetic
The reading for the week of Jan. 19, recomputed
StepWith itWithout
Counts toward the index?documented, external, eligible evidenceNo—
Worst documented harm, ksets the band— (none counting)— (none counting)
Harms at that level, nposition in the band00
Highest control level breachedsets the reading only when no harm counts44
Readingrounded down4 Control failures only4 Control failures only
Inside the window of 4 weekly readings
Week toReadingBand
Jan. 19, 20264Control failures only
Jan. 26, 20264Control failures only
Feb. 2, 20262Control failures only
Feb. 9, 20266Negligible harm

Recalculated backcasts, not readings published at the time.

Revisions

What we changed

6 logged. Every change to a rating is logged here, with the reason.

  1. v6
    Oct. 6, 2026

    Ratings confirmed by the editor.

  2. v5
    Oct. 3, 2026

    Audit corrections. Verification changed from Multiple credible sources to Single source, with a research evidence review citing PromptArmor: the articles repeat PromptArmor's demonstration, and Anthropic's statement to The Register promised a change without confirming the test. Recorded both models shown vulnerable, dated The Decoder, and named Rehberger as the earlier reporter in the summary. Ratings unchanged.

  3. v4
    Oct. 2, 2026

    Status changed from resolved to unknown: PromptArmor reported the flaw unpatched at disclosure, and Anthropic only said a fix would ship (The Register, 15 Jan 2026).

  4. v3
    Oct. 2, 2026

    Added first-hand sources: PromptArmor's disclosure and Johann Rehberger's earlier write-up of the Files API exfiltration path.

  5. v2
    Sept. 30, 2026

    Rated: impact not reported; control type instruction violation.

  6. v1
    Sept. 30, 2026

    Backfilled from public reporting.

Cite and share

Use this record

Citation

Paperclip Index. “Hidden text in a document made Anthropic's Claude Cowork upload user files to an attacker's account.” Record PI-0038. Reported Jan. 14, 2026; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0038