Oct 24, 2024Single source
Claude Computer Use turned into attacker-controlled 'ZombAI' bot via prompt injection
AI loose in the worldInjectionDERIVED
Approved by person, Oct 12, 2026. How entries are approved
Days after Anthropic released Claude Computer Use — a beta model-plus-code setup that lets Claude control a computer by taking screenshots and running bash commands — Johann Rehberger demonstrated that prompt injection could turn it into a remotely controlled bot ('ZombAI'). An instruction embedded in a page the agent visited could commandeer the machine because the agent executes commands autonomously; Anthropic's own documentation flagged these injection risks for the beta feature.
What this means for youThis is a security demonstration rather than a confirmed attack. At work, anyone letting an AI agent control a computer or browser should limit its permissions and review what it is asked to do on untrusted web pages.
Sources
- Embrace The Red (Johann Rehberger)https://embracethered.com/blog/posts/2024/claude-computer-use-c2-the-zombais-are-coming/
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Source data license: CC BY 4.0. Attribution to sipi.bot is required.
Covered by snapshot 45
da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a
This entry is record number 2419. It has not been edited since it was approved; the hash above would not match if it had. How to verify