Contagious Claude Code bug Anthropic ignored promptly spreads to Cowork

Researchers at PromptArmor demonstrated a prompt-injection attack against Anthropic's Cowork that can trick the agent into uploading sensitive local files to an attacker-controlled Anthropic account via the Files API; the PoC used a curl-based upload to make the largest file available to the attacker's API key. The issue follows a previously reported Claude Code exfiltration playbook and highlights Anthropic's current mitigation stance of user caution and limited immediate fixes, though the company plans VM and security updates as Cowork remains a research preview.