Claude AI, popular among many programmers and vibe coding enthusiasts, was recently found to have a serious security vulnerability. The well-known security research team Oasis Security recently disclosed a severe exploit chain called “Claudy Day” in Anthropic’s Claude.ai platform. This vulnerability not only exposes a new type of weakness in identity and access management (IAM) on mainstream AI platforms, but also demonstrates how attackers can secretly steal sensitive information from conversation records without users noticing.
Claude AI hit by “Claudy Day” vulnerability attack chain
“Claudy Day” is not a single software bug, but a chain of three independent vulnerabilities. The most alarming aspect of this attack chain is that it can operate within Claude.ai’s default chat environment without any assistance from external integration tools or Model Context Protocol (MCP) servers. This means any ordinary user who uses Claude for daily work could fall prey to attackers simply by clicking on what appears to be a legitimate link.
The Trinity’s Fatal Blow: Deconstructing the Claudy Day Vulnerability Structure
According to Oasis Security’s official report, the core of “Claudy Day” is made up of three distinct vulnerability types: Invisible Prompt Injection, Data Exfiltration, and Open Redirect. These three elements are interconnected, forming a complete attack path.
The first is “invisible prompt injection.” Researchers found that Claude.ai offers a feature allowing users to, through specific URL parameters (for example claude.ai/new?q=...) to prefill the conversation prompt. Attackers exploit design flaws in this feature by embedding carefully crafted malicious HTML tags within the URL. After processing, these tags are invisible to users but serve as clear, readable instructions for the backend AI model. This allows attackers to secretly issue instructions to the AI without arousing the user’s suspicion.
The second technique is data exfiltration. Once the hidden instruction is triggered, the attacker instructs Claude to search the user’s conversation history for sensitive keywords related to financial plans, medical consultations, or internal corporate secrets. Then, using an Anthropic Files API key they control, the attacker forces Claude to upload the collected data to the attacker’s account. Since all of this happens in the background, the user sees no trace of data exfiltration in the chat interface.
The final link is the “open redirect” vulnerability. The study notes thatclaude.com/redirect/<target> The path has an unvalidated redirect vulnerability. Attackers can combine this flaw with Google Ads’ delivery features to craft malicious links that appear to come entirely from the legitimate Claude domain. When users search for related keywords on a search engine, they are highly likely to be tricked into clicking these highly credible ads, thereby triggering the entire attack chain.
High-Risk Alert: A Comprehensive Threat from Personal Privacy to Corporate Secrets
Cybersecurity experts have rated the risk level of “Claudy Day” as “high risk.” The danger lies in attackers’ ability to carry out highly precise targeted attacks. Through Google Ads’ precise targeting capabilities, attackers can target professionals in specific industries or engineers searching for specific technical issues. Once a victim enters a compromised conversation environment, all the knowledge bases and conversation highlights they have accumulated on that platform could change hands in an instant.
The impact is not limited to ordinary conversations. If a user connects to an MCP (Model Context Protocol) server, a third-party API, or uploads sensitive internal corporate files to boost productivity, the range of resources an attacker can access will expand further. This means “Claudy Day” could become a new breach point for corporate data leaks, rendering traditional perimeter defenses and endpoint security software ineffective, because the attack is happening directly inside a trusted AI service.
Anthropic’s Response and Follow-up Patching Progress
After discovering the vulnerabilities, the Oasis Security research team followed the Responsible Disclosure Program and immediately reported its findings to Anthropic. Anthropic took the issue very seriously and responded swiftly. According to current information, Anthropic has already patched the most critical “prompt injection” vulnerability, preventing malicious instructions from infiltrating through URL parameters.
Regarding the open redirect issue and some instances of API abuse, the relevant patches are still being developed and tested. Anthropic recommends that users stay alert during sensitive conversations and avoid clicking conversation invitation links from unknown sources. Meanwhile, the research team also notes that this incident highlights the inadequacy of existing identity and access management (IAM) frameworks in dealing with AI agent behavior. Traditional IAM designs are aimed at “human operators” or “traditional software programs” and do not account for the possibility that AI agents, after receiving malicious prompts, may autonomously carry out destructive actions.
New Security Challenges for AI Agents: From OpenClaw to Claude
Notably, “Claudy Day” was not an isolated incident. Oasis Security also recently disclosed vulnerabilities related to OpenClaw, indicating that the risk of AI agent hijacking is increasing globally. When AI agents are granted permissions to “see” the network, “read” files, and “invoke” APIs, they themselves become a powerful attack vector.
For enterprises, establishing a cybersecurity governance framework for AI applications is now imperative. This includes auditing AI conversations, strictly restricting API call permissions, and providing employees with training on AI phishing attacks. Until a full patch is released, Claude users are advised to regularly clear sensitive conversation history and, when handling confidential information, prioritize using enterprise services with higher security tiers.
Source: KOCPC Chinese