Back Gbhackers

Claude Vulnerabilities Allow Data Exfiltration and Malicious Redirect Attacks

Gbhackers •Divya • March 19, 2026

Security researchers recently uncovered a critical attack chain within Anthropic’s Claude.ai platform. Dubbed “Claudy Day,” this vulnerability sequence allows attackers to silently extract sensitive user data through prompt manipulation and malicious redirects. The exploit requires no external integrations or specialized tools, functioning entirely within a default Claude session. Anthropic has patched the prompt injection flaw […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Claude.ai Enable Data Theft and Malicious Redirects A series of vulnerabilities in Anthropic's Claude.ai, collectively termed 'Claudy Day', have been identified, allowing attackers to exfiltrate sensitive user data and redirect users to malicious sites. The attack chain consists of three flaws: an invisible prompt injection via URL parameters, an open redirect on claude.com, and data exfiltration through the Anthropic Files API. These vulnerabilities can be exploited without any external tools or integrations, posing a significant risk to users. Researchers from Oasis Security discovered these flaws and reported them to Anthropic, which has since patched the prompt injection vulnerability but is still addressing the other issues. The vulnerabilities can lead to unauthorized access to sensitive user conversation history, especially in enterprise settings where integrations are enabled. Security experts emphasize the need for organizations to audit their AI integrations to mitigate these risks. The attack vector allows for silent data exfiltration, making it particularly dangerous for users unaware of the risks. The situation remains critical as organizations must remain vigilant against potential exploitation. 4 sources 69

Extracted Entities

Claude Vulnerabilities Allow Data Exfiltration and Malicious Redirect Attacks

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Companies (1)

MITRE ATT&CK (2)