Poison Claude Sells Stolen Claude Access, Intercepts All Prompts

Thu, 06 Aug 2026 13:03:19 +0000

Engineer — Plan: Underground AI proxy services capturing user prompts represent a shadow-IT risk if employees seek cheaper LLM access; audit API usage logs for unauthorized AI service traffic and enforce an approved-services allow-list.
SOC/IR — Learn: Emerging TTP: threat actors operate MITM-style LLM proxy services to harvest organizational prompts at scale; no IOCs provided, but this informs future DLP and proxy-monitoring detection design for AI service abuse.
Leader — Plan: If employees use discounted underground AI services, proprietary business data in their prompts flows directly to threat actors; review and communicate AI acceptable-use policy and evaluate DLP controls for prompt exfiltration this quarter.

Shadow-It on CuraSec