Home/ Incident database/claude-computer-use-c2-2024-10
Data breach Prompt injection verified

Claude Computer Use turned into attacker-controlled 'ZombAI' bot via prompt injection

Anthropic (Claude Computer Use) · Oct 24, 2024 · General agent

What happened

Days after Anthropic released Claude Computer Use — a beta model-plus-code setup that lets Claude control a computer by taking screenshots and running bash commands — Johann Rehberger demonstrated that prompt injection could turn it into a remotely controlled bot ('ZombAI'). An instruction embedded in a page the agent visited could commandeer the machine because the agent executes commands autonomously; Anthropic's own documentation flagged these injection risks for the beta feature.

Loss / impact
Oct 24
2024
Prompt
Failure mode
General
Agent type

Causal vector

A computer-use agent that runs bash autonomously was hijacked into a command-and-control bot via injected page content

Source

Reported by Embrace The Red (Johann Rehberger). Verified against the primary report.

Read the original report ↗

How a spend firewall would have helped

A computer-use agent that runs commands on an attacker's instruction is a velocity and allowlist problem: every command outside an approved set and every outbound connection should be a policy-gated transaction. The firewall refuses the C2 callback the moment it is not on the allowlist, whatever the page told the agent to do.

The six rule types that contain this class of failure

Per-transaction cap

Any single spend above your ceiling is BLOCKED before it moves.

Daily total

Cumulative spend across all agent calls, bounded per day.

Velocity limit

Stops runaway retry loops — the #1 cause of overnight losses.

Merchant allowlist

Only approved destinations can ever receive funds.

Category rules

Flag high-risk classes (crypto, infra, refunds) for review.

Approval threshold

Above a value, the action waits for a human.

Related incidents

Don't be the next entry

Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 67 documented failures, one control.