# Code Interpreter Outbound Secret Payload

- **Severity:** High
- **Signature ID:** `7f3c9a41-2d68-4e5b-9c07-1ab4d8e6f052`
- **MITRE ATLAS:** AML.T0024.000 (Infer Training Data Membership), AML.T0025 (Exfiltration via Cyber Means)
- **OWASP:** LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

This rule flags a single outbound web request from a Claude Code Interpreter session that contains actual secret material - like an API key, password, or the contents of a credentials file - inside the request body or URL. It catches the exfiltration attempt itself, even if the attacker never touched the local file system.

## How the attack works

An attacker, either controlling the interpreter directly or manipulating it through a prompt injection, gets the session to obtain sensitive data - often pulled through the model's own context rather than read from disk. The session then uses its network access to send that data, wrapped in a field shaped like an exfiltration payload, to an external destination. Because the data never touched the file system, sequence-based detections that wait for a file-read step beforehand won't see this. This rule instead inspects the outbound request on its own, so it can catch the very first network call a session makes, before any prior activity exists.

## Why it matters

An organization can lose API keys, session credentials, or the contents of credential files (SSH keys, AWS credentials, etc.) to an outside party, potentially enabling further account or infrastructure compromise.

## What you can do

- Restrict which destinations a code interpreter session is allowed to reach over the network, ideally via an allowlist.
- Avoid storing long-lived credentials in locations or context accessible to an AI interpreter session; use short-lived, scoped tokens instead.
- Review any outbound request from an interpreter session that contains high-entropy strings, key-like patterns, or file paths such as .aws/credentials or .ssh/id_rsa.
- When legitimate secret-scanning or credential-provisioning tools do send credential material, route them through separate, clearly identified service accounts so their traffic is easy to distinguish from an interpreter session's own calls.

## Known benign look-alikes

- Secret-scanning tooling (gitleaks, trufflehog, detect-secrets) shipping findings to a dashboard or ticketing API -- suppressed only when both the scanner name and the finding-record shape are present in the same body.
- Legitimate credential provisioning by an operator or IaC agent - uploading a deploy key, creating a CI/CD or Kubernetes secret, or pushing a Vault/SOPS payload that genuinely contains a PRIVATE KEY block.
- Backup, sync or migration agents uploading an archive whose manifest lists ~/.aws/credentials or ~/.ssh/id_rsa alongside a large base64 blob (branch C).
- Log-shipping agents forwarding application logs in which a token was accidentally written in full.
- Developers posting a real-format but throwaway test credential to a request-inspection endpoint while debugging; the placeholder filter only catches masked or templated values.
- Security training or incident-report content that quotes a full-length real key verbatim rather than a redacted one.

## References

- https://atlas.mitre.org/techniques/AML.T0024
- https://atlas.mitre.org/techniques/AML.T0025
- https://attack.mitre.org/techniques/T1567/

---
Source: https://www.netzilo.com/threats/code-interpreter-api-exfil-content