Darktrace Demonstrates AI Agent Memory Stores as Covert C2 Channel in Lab Test

Darktrace's Signal Labs has published research showing how threat actors who have already compromised a device and stolen a user's Claude credentials could abuse the Claude platform's memory stores feature to establish a live command-and-control channel with internal Claude Code agents. The work was conducted in a controlled laboratory environment and has not been observed in operational attacks, the company said [1].

What the research shows

Darktrace researchers simulated a corporate Active Directory environment with a Linux device running a Claude Code agent harness. After establishing initial access and collecting the user's Claude Console API credentials via a shell payload, they added a memory store containing three memory files — a heartbeat file, an input file for instructions, and an output file for results — to the user's Claude workspace via the Claude API [1].

They then used a transient systemd service unit to repeatedly spawn Claude Code harness processes. Each process checked in via the heartbeat file, retrieved a natural-language task from the input file, executed it using the model's tool-calling capabilities, and posted results to the output file. The external operator monitored the output file and updated the input file with new tasks, creating an interactive feedback loop entirely through channels native to the agent's normal functioning [1].

The demonstration progressed through nine tasks, including network reconnaissance, service enumeration, FTP credential harvesting, username list generation, password spraying, SMB share enumeration (two steps), and downloading, splitting, and exfiltrating a 1 GB file via the Claude Files API [1].

Important limitations

Several caveats frame the findings. First, the technique requires an attacker to have already compromised a device and obtained valid Claude Console credentials — it is not an initial-access vector. Second, it does not rely on a vulnerability in the Claude platform; it repurposes legitimate features. Third, Darktrace explicitly states this memory-store C2 method has not been observed in the wild [1]. The German security outlet aifence.de confirmed the lab-only character and noted that no comparative testing against other agent platforms was performed [3].

Detection depends on behavioral analysis

Because the C2 traffic travels over the same Claude API endpoint used for normal inference, traditional network signatures are ineffective. Darktrace argues detection requires correlating process creation and network traffic from agent harness processes with behavioral baselines — flagging deviations such as unusual command-line arguments, atypical data transfer ratios, or agent processes accessing internal resources outside their documented workflow [1].

Context: living off the land extends to AI

The research extends the established "living off the land" concept to enterprise AI agents. Darktrace cites prior reporting of credential stealers (QUIETVAULT, s1ngularity, SANDWORM_MODE, DUSTMAKER) offloading collection tasks to AI agents on infected devices, but notes those cases lacked an interactive feedback loop [1]. The memory-store technique demonstrates how such a loop could be achieved without a separate malware implant.

Anthropic's own documentation warns that manipulated inputs in writable memory stores can persist harmful content and recommends read-only access for reference material [3]. Darktrace's experiment configured the local agent to treat memory contents as executable task queues — effectively turning a knowledge store into an administration interface.

What remains unknown

The research does not establish how prevalent Claude Code deployments are in enterprise environments, whether the memory stores feature is widely used, or how readily attackers could obtain valid Claude Console credentials in real intrusions. It also does not test whether similar techniques apply to other agent platforms (GitHub Copilot, Cursor, etc.). Darktrace's detection guidance is tied to its own behavioral analytics product.