Data Destruction via Indirect Prompt Injection in Claude Computer-Use
Claude Computer-Use
Researchers demonstrated that an indirect prompt injection embedded in a PDF file could trick Claude Computer-Use into invoking bash commands. The attack resulted in simulated deletion of the victim filesystem.
- first report
- 30 Jan 2026
- last update
- 30 Jan 2026
Timeline · 2
Sources · 2
News and write-ups
- 2026-01-30Indirect Prompt Injection of Claude Computer UseHiddenLayer · hiddenlayer.com/innovation-hub/indirect-prompt-injection-of-claude-computer-use
Research and catalogues
- 2026-01-30Data Destruction via Indirect Prompt Injection Targeting Claude Computer-UseMITRE ATLAS · atlas.mitre.org/studies/AML.CS0046
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Research
- AI role
- Attack on AI
- categories
- Prompt injectionAgent hijack
- severity
- 1 · Research / proof of concept
- targets
- Anthropic, Framework / tooling
- owasp llm top 10
- LLM01:2025 Prompt InjectionLLM06:2025 Excessive Agency
- dates
- happened 24 Oct 2024 · first reported 30 Jan 2026
- origin
- MITRE ATLASDerived from MITRE ATLAS (Apache 2.0, © MITRE).
- record
- confidence 0.95 · created 2026-10-18 06:55Z · updated 2026-10-18 06:55Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# Data Destruction via Indirect Prompt Injection in Claude Computer-Use https://gcdradar.vercel.app/incidents/data-destruction-via-indirect-prompt-injection-in-claude-com · AIR-2026-0340 · closed 2026-02-13 - Lane: Research - Severity: 1 (Research / proof of concept) - Fix status: Fix status unknown - First reported: 2026-01-30 (happened 2024-10-24) - AI role: Attack on AI - Products: Claude Computer-Use ## Summary Researchers demonstrated that an indirect prompt injection embedded in a PDF file could trick Claude Computer-Use into invoking bash commands. The attack resulted in simulated deletion of the victim filesystem. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2026-01-30: Indirect Prompt Injection of Claude Computer Use (https://hiddenlayer.com/innovation-hub/indirect-prompt-injection-of-claude-computer-use) - 2026-01-30: Data Destruction via Indirect Prompt Injection Targeting Claude Computer-Use (https://atlas.mitre.org/studies/AML.CS0046) ## Sources - 2026-01-30 MITRE ATLAS: Data Destruction via Indirect Prompt Injection Targeting Claude Computer-Use https://atlas.mitre.org/studies/AML.CS0046 - 2026-01-30 HiddenLayer: Indirect Prompt Injection of Claude Computer Use https://hiddenlayer.com/innovation-hub/indirect-prompt-injection-of-claude-computer-use Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closedClaude Code + SDKs Security Impact of Coding Agent's Memory Files
Research · since 30 Oct 2026
AI - closedClaude Code GitHub Action Claude Code GitHub Action Secret Exposure via Prompt Injection
Research · since 5 Jun 2026
AI - closed9.8Langflow CVE-2026-27966: Langflow Remote Code Execution in CSV Agent
Patch now · Disclosed · since 27 Feb 2026 · updated 27 Feb 2026 · CVE-2026-27966
AI - closed9.9Semantic Kernel RCE Vulnerability in Microsoft Semantic Kernel Search Plugin
Research · since 7 May 2026 · updated 30 Jun 2026 · CVE-2026-26030
AI - closedClawdBot Poisoned ClawdBot Skill Distributed on Registry
Research · since 26 Jan 2026
AI - closedOpenClaw OpenClaw Command and Control via Indirect Prompt Injection
Research · since 3 Feb 2026
AI