News for hackers. Stuff that matters.

A comment on Claude Cowork Exfiltrates Files. Parent comment

Re:Claude Cowork Exfiltrates Files by alienbaby on Wednesday January 14, 2026 @05:49PM (#46625036)
Until Claude decides to build its own tool on the fly to talk to your dB and drop the tables
[ Parent | on HN ]
Re:Claude Cowork Exfiltrates Files by spockz on Wednesday January 14, 2026 @05:58PM (#46625163)
That is why the credentials used for that connection are tied to permissions you want it to have. This would exclude the drop table permission.
[ Parent | on HN ]
Re:Claude Cowork Exfiltrates Files by dehugger on Thursday January 15, 2026 @02:08AM (#46629111)
What makes you think the dbcredentials or IP are being exposed to Claude? The entire reason I build my own connectors is to avoid having to expose details like that.

What I give Claude is an API key that allows it to talk to the mcp server. Everything else is hidden behind that.

[ Parent | on HN ]