Claude Code 'Claudy Day' Vulnerability Chain — Silent Data Exfiltration via Prompt Injection (2026)

Incident Summary

Security researchers discovered a vulnerability chain in Claude.ai — dubbed “Claudy Day” — that combined prompt injection, API misuse, and open redirect vulnerabilities to enable silent data exfiltration from user conversations and redirection to malicious sites.^[1] The chain operated without visible indicators to the user, meaning that data could be extracted from conversations without the user being aware that their information was being sent to an attacker-controlled endpoint.^[2] The vulnerability was patched after responsible disclosure. The “Claudy Day” chain demonstrates that modern AI web applications face the same categories of web security vulnerabilities as traditional web applications (open redirects, API misuse), but with the added dimension that prompt injection can be used to chain these vulnerabilities together, with the AI system itself acting as the bridge between separate vulnerabilities that would not be exploitable in isolation.

Key Facts

• Vulnerability: Chain combining prompt injection + API misuse + open redirects^[1]
• Impact: Silent data exfiltration and malicious redirection^[1]
• Stealth: No visible indicators to user during exfiltration^[2]
• Status: Patched after responsible disclosure^[1]
• Platform: Claude.ai web application^[2]

Threat Patterns Involved

Primary: Prompt Injection Attack — The Claudy Day chain uses prompt injection as the initiating vulnerability that enables the AI system to be directed to exploit API misuse and open redirect vulnerabilities, demonstrating how prompt injection serves as a universal vulnerability amplifier in AI web applications.

Significance

1. AI as vulnerability bridge — The chain demonstrates that AI systems can bridge separate web vulnerabilities that would not be exploitable individually, creating a new category of chained attacks where the AI acts as the connecting element
2. Silent exfiltration — The absence of visible indicators during data exfiltration means users cannot detect the attack through normal observation, requiring technical monitoring to identify the vulnerability exploitation
3. Web application security applies to AI — The vulnerability demonstrates that AI web applications inherit all traditional web security challenges (open redirects, API misuse) while adding the new dimension of prompt injection, requiring AI security to encompass both AI-specific and traditional web security practices
4. Responsible disclosure success — The patching of the vulnerability after responsible disclosure demonstrates that the AI security ecosystem’s vulnerability disclosure processes can function effectively when researchers and developers cooperate