Researcher Exfiltrates Secrets from Claude Code via DNS Rebinding Attack
Teja_Swaroop · reddit · 2026-07-31
A security researcher tested Claude Code's defenses against malicious Skills, finding that while it catches obvious prompt injections, it can be bypassed using a disguised DNS rebinding attack.
Attack Mechanism
The attacker hides the malicious payload at the network layer, unreadable by the model. The Skill appears as a normal CI/CD readiness gate, but at runtime, the requested domain resolves to a private IP (e.g., 172.18.0.10) via DNS rebinding. Because the agent's environment (like curl or Python) lacks browser protections like the Same-Origin Policy, the Skill successfully reads secret data from an internal notes app and sends it to the attacker. Claude Code (Opus 4.8) flagged nothing and executed the exfiltration.
Defenses
The researcher emphasizes that model-level inference is non-deterministic and shouldn't be treated as a reliable safety layer. Recommended defenses include:
- Host level (highly recommended): Use tools like dnsmasq to prevent DNS rebinding.
- Router level: Enable DNS rebind protection.
- Service level: Place internal services behind a reverse proxy with a Host-header allowlist (though headers can be spoofed).
More from coding & agent
- Tencent Releases UI-Mate-27B, a Desktop GUI Agent Model — tencent · 2026-08-24
- Comparing AI Subscriptions: DeepSeek API vs. Claude Pro vs. Local LLMs — Unlikely_Bluejay5392 · 2026-08-24
- Claude Code introduces 'Remote Control' feature to boost coding efficiency — rohanpaul_ai · 2026-08-24
- rauchg lays out fx extension philosophy: MCP, Skills, Plugins and Unix composition — AccBalanced · 2026-08-24
- Netflix details its production LLM judge: hundreds of thousands of recommendations scored weekly — omarsar0 · 2026-08-24
- smolvm passes Simon Willison's Fable 5 agent test as a secure sandbox — yawnxyz · 2026-08-24