TLDR Tech / InfoSec
'Claudy Day' Trio of Flaws Exposes Claude Users to Data Theft
Oasis Security researchers combined three vulnerabilities — an invisible prompt injection through URL parameters, an open redirect on claude.com, and data exfiltration via the Anthropic Files API into a single attack called "Claudy Day." When a victim clicks a malicious Google search result, it loads covert instructions that silently extract conversation history, save it to a file, and then upload it to the attacker's Anthropic account. If MCP servers or integrations are active, the attack's impact extends to files, messages, and connected APIs.
Read the full story