Researcher Exfiltrates Secrets from Claude Code via DNS Rebinding Attack
Teja_Swaroop · reddit · 2026-07-31
A security researcher tested Claude Code's defenses against malicious Skills, finding that while it catches obvious prompt injections, it can be bypassed using a disguised DNS rebinding attack.
Attack Mechanism
The attacker hides the malicious payload at the network layer, unreadable by the model. The Skill appears as a normal CI/CD readiness gate, but at runtime, the requested domain resolves to a private IP (e.g., 172.18.0.10) via DNS rebinding. Because the agent's environment (like curl or Python) lacks browser protections like the Same-Origin Policy, the Skill successfully reads secret data from an internal notes app and sends it to the attacker. Claude Code (Opus 4.8) flagged nothing and executed the exfiltration.
Defenses
The researcher emphasizes that model-level inference is non-deterministic and shouldn't be treated as a reliable safety layer. Recommended defenses include:
- Host level (highly recommended): Use tools like dnsmasq to prevent DNS rebinding.
- Router level: Enable DNS rebind protection.
- Service level: Place internal services behind a reverse proxy with a Host-header allowlist (though headers can be spoofed).
More from coding & agent
- Connected steps are not a workflow: nobody designs the handoff — usehive · 2026-10-16
- Making Blender animations with Opus, Astra and Argon: how you prompt still matters — chongdashu · 2026-10-16
- Running PolyStrata + Cline coding agent on a $0-fancy laptop at ~90 tok/s — rpwoerk · 2026-10-16
- How do you attribute agent gains: model training or infrastructure? — jrxna · 2026-10-16
- Feed Claude your books, blogs and top engineers' code for claude.md — 'it now writes better code than me' — blaizedsouza · 2026-10-16
- Open-source /label plugin auto-names and colors Claude Code sessions in one step — hermanschutte · 2026-10-16