Three vulnerabilities in Anthropic’s Claude AI, when chained together, create an end-to-end attack that can steal sensitive user data without any visible indication that something has gone wrong. No pop-ups. No warnings. Just a quiet siphon of information flowing out through what appears to be a perfectly normal conversation.
The findings, disclosed by security researcher Johann Rehberger and reported by TechRadar, represent one of the most complete attack demonstrations against a major commercial AI assistant to date. Rehberger didn’t just find theoretical weaknesses. He built a working exploit chain that moves from initial compromise to data theft in a sequence that most users — and many security professionals — would never detect in real time.
The attack begins with prompt injection, the original sin of large language model security. In this case, a malicious instruction is embedded in content that Claude processes — a document, a web page, a pasted block of text. Claude reads the hidden directive and follows it, overriding or supplementing whatever the user actually asked it to do. This is the first vulnerability: Claude’s inability to reliably distinguish between instructions from its user and instructions embedded in data it’s asked to analyze.
But prompt injection alone doesn’t get data out. That’s where the second vulnerability comes in. Rehberger discovered that Claude’s responses can include markdown image tags — tiny, invisible references to external URLs that the user’s browser automatically fetches. When Claude renders a response containing something like an image tag pointing to an attacker-controlled server, the browser dutifully pings that server. And the URL itself can carry stolen data encoded as parameters. The user sees nothing unusual. Maybe a broken image icon, maybe not even that. Meanwhile, their information has already left the building.
The third piece of the chain is what makes the whole thing especially dangerous. Claude, when operating within certain tool-use or multi-turn contexts, can access and reference information from earlier in the conversation — including sensitive data the user may have shared. The prompt injection tells Claude to gather that information. The markdown rendering exfiltrates it. Three vulnerabilities, each individually concerning, become devastating in combination.
Rehberger, who has built a reputation for probing AI systems at their boundaries, documented the attack with enough specificity that Anthropic was able to respond. According to TechRadar, Anthropic acknowledged the findings and has been working on mitigations, though the company hasn’t publicly detailed exactly which fixes have been deployed or when. That opacity itself is telling. AI companies are still figuring out how to communicate about security vulnerabilities in systems that don’t fit neatly into traditional software disclosure frameworks.
The prompt injection problem is not new, and it’s not unique to Claude. OpenAI’s ChatGPT, Google’s Gemini, and virtually every other LLM-based product have grappled with variations of the same fundamental issue: these models process text as both instruction and data, and they can’t always tell which is which. Researchers have been raising alarms about this for over two years. What Rehberger’s work demonstrates is that the problem isn’t just theoretical anymore. It’s weaponizable. And the weapons work.
What separates this disclosure from many prior prompt injection demonstrations is the completeness of the kill chain. Most published attacks against AI assistants show one step — tricking the model into saying something it shouldn’t, or getting it to ignore its safety guidelines. Interesting, but limited in real-world impact. Rehberger went further. He showed the full path from initial compromise to actual data exfiltration, with the user none the wiser. That’s the difference between a proof of concept and a practical threat.
The markdown image exfiltration technique deserves particular attention because it exploits a feature, not a bug, in how web browsers work. Browsers fetch images automatically. That behavior is fundamental to how the web operates. When an AI assistant’s output is rendered in a browser context — as it is in Claude’s web interface — any image reference in that output triggers an outbound request. Encoding stolen data in the URL parameters of that request is a technique that predates AI by decades. It’s been used in cross-site scripting attacks, email tracking pixels, and countless other contexts. Rehberger simply applied an old trick to a new target.
And that’s part of what makes AI security so difficult right now. The attack surface isn’t just the model. It’s the model plus the interface plus the browser plus the user’s expectations about what’s happening. Each layer introduces its own assumptions, and attackers exploit the gaps between those assumptions.
Anthropic has positioned itself as the safety-focused AI company, the one that thinks hardest about risks and alignment. Its constitutional AI approach and its emphasis on responsible development have earned it significant credibility in policy circles. So vulnerabilities like these carry reputational weight beyond their technical severity. If the company that talks most about safety can’t prevent a three-step data exfiltration chain in its flagship product, what does that say about the industry’s ability to secure these systems at scale?
To be fair, no AI company has solved prompt injection. Not really. There are mitigations — input filtering, output sanitization, instruction hierarchy schemes that try to give user prompts priority over injected content. Some of these help. None of them are foolproof. The fundamental architecture of transformer-based language models doesn’t include a clean separation between code and data, between command and content. Until that changes — if it changes — prompt injection will remain a persistent threat vector.
The security research community has been increasingly focused on AI-specific vulnerabilities throughout 2024 and into 2025. OWASP updated its Top 10 list for LLM applications, placing prompt injection at the very top. NIST has published guidance on AI risk management that explicitly addresses adversarial manipulation of model inputs. And a growing number of startups are building tools specifically designed to detect and prevent prompt injection attacks in production AI systems.
But the defenders are playing catch-up. The models are shipping faster than the security tooling can mature. Enterprises are deploying AI assistants with access to internal documents, customer data, financial records — all the things an attacker would want to exfiltrate. And many of those deployments happen without a thorough threat model that accounts for the kinds of attacks Rehberger demonstrated.
There’s a broader pattern here worth examining. Every major computing paradigm has gone through a phase where functionality raced ahead of security. Web applications in the early 2000s. Mobile apps in the early 2010s. Cloud infrastructure throughout the last decade. Each time, the industry learned hard lessons about what happens when you prioritize features over security architecture. AI is following the same trajectory, just faster.
The specific risk with Claude’s vulnerability chain is amplified by the growing use of AI assistants in professional contexts. Lawyers paste confidential case documents into AI tools. Financial analysts feed them proprietary data. Healthcare workers ask them to summarize patient records. In each of these scenarios, a successful exfiltration attack doesn’t just compromise one user’s data — it potentially exposes information belonging to clients, patients, or counterparties who never consented to their data being processed by an AI system in the first place, let alone stolen from one.
Rehberger’s work also highlights a tension in how AI companies handle security disclosures. Traditional software vendors have well-established processes: a researcher finds a bug, reports it through a coordinated disclosure program, the vendor patches it, and a CVE is issued. AI vulnerabilities don’t always fit this model. Prompt injection isn’t a single bug that can be patched with a code fix. It’s a class of vulnerability rooted in how the technology fundamentally works. So what does “fixing” it even mean?
Anthropic, for its part, has a responsible disclosure program and has engaged with security researchers. But the company’s public communications about specific vulnerabilities tend to be sparse. That’s not unusual in the AI industry — OpenAI and Google are similarly tight-lipped about specific security issues in their models. The argument is that publicizing detailed attack techniques could enable malicious actors. The counterargument is that security through obscurity has never worked for long, and that users deserve to understand the risks of the tools they’re using.
The three vulnerabilities Rehberger identified — prompt injection, markdown-based exfiltration, and context data access — each have implications that extend beyond Claude. Any AI assistant that renders its output in a web browser, that processes untrusted input alongside user data, and that maintains conversational context is potentially susceptible to similar attack chains. The specific implementation details will vary, but the structural weaknesses are shared across the industry.
So where does this leave enterprises and individual users who depend on AI assistants? A few practical takeaways emerge. First, don’t paste sensitive data into AI tools that process untrusted content in the same session. If you’re asking Claude to analyze a document from an external source, don’t do it in the same conversation where you’ve shared confidential information. Second, organizations deploying AI assistants should implement network-level monitoring that can detect unusual outbound requests from AI interface sessions. Third, AI vendors need to invest more aggressively in output sanitization — stripping or neutering potentially dangerous elements like external image references before they reach the user’s browser.
None of these are complete solutions. They’re risk reductions. And they require a level of security awareness that most users simply don’t have. The average person using Claude to help draft an email or summarize a report isn’t thinking about markdown image tags or URL parameter encoding. They shouldn’t have to. The burden of securing these systems belongs to the companies that build and deploy them.
Rehberger’s research is a reminder that AI security isn’t a solved problem. It’s barely a defined problem. The attack surfaces are novel, the threat models are immature, and the pace of deployment far outstrips the pace of defensive innovation. The three vulnerabilities in Claude aren’t an indictment of Anthropic specifically — they’re a signal that the entire industry needs to treat security as a first-order engineering priority, not an afterthought bolted on after the product ships.
The question isn’t whether more attack chains like this will be discovered. They will. The question is whether AI companies will build the security infrastructure to catch them before researchers — or worse, actual attackers — do.
WebProNews is an iEntry Publication