Claude Gets Tricked Into Mailing Your Chat History to a Stranger's Anthropic Account

What happened

A security researcher demonstrated an indirect prompt injection attack that tricked Anthropic's Claude into saving a user's recent chat to its Code Interpreter sandbox and uploading it through the Files API to an attacker's account. The default 'Package managers only' network setting allowed api.anthropic.com. Anthropic initially closed the report as a out-of-scope safety issue, then said such vulnerabilities are in scope.