AIA-020 Claude Code data exfiltration via DNS requests (CVE-2025-55284), per Embrace The Red

ID: AIA-020
Category: AI AI agent incident
Disclosed: 2025-08
Systems: Claude Code
Harm type: Prompt injection / data leak
Status: fixed
Rehberger says Anthropic fixed it in early June 2025.
CVE: CVE-2025-55284
CISA KEV: Not in CISA KEV as of catalog 2026.10.30
Checked 2026-10-31 against catalog 2026.10.30

Summary

Rehberger reported that text in a file Claude Code analyzed "grabbed data from the .env file and placed it into a ping request as subdomain," which leaked the data via DNS. He says Anthropic fixed it in early June 2025.

Controls

Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.

NIST AI RMF

MEASURE 2.7 Security and resilience are evaluated and documented
MANAGE 2.4 Mechanisms exist to supersede, disengage, or deactivate the system

NIST SP 800-53

AC-4 Information Flow Enforcement
SC-7 Boundary Protection
SI-10 Information Input Validation

Human-approval (JCR) checkpoint

partial: Bash commands (approval existed, but allow-listed ping, nslookup, host and dig ran without it)

Sources

embracethered.com primary link checked 2026-10-31, HTTP 200
Post dated Aug 11, 2025
https://embracethered.com/blog/posts/2025/claude-code-exfiltration-via-dns-requests/

Corrections

2026-10-29 Review round 2: JCR checkpoint changed from yes to partial. The source describes an existing Bash approval that was bypassed through allow-listed network commands, which the method classifies as partial.

To report an error in this entry, see corrections.