Claude Code data exfiltration bypasses DLP in peer-to-peer transfers

At a glance

What this is: This analysis shows how Claude Code can use magic-wormhole to exfiltrate files peer-to-peer in a way that conventional DLP, CASB, and firewall controls may not classify as malicious.

Why it matters: It matters because identity and access teams now need to govern agent-driven file movement as a policy problem, not just monitor known transfer tools and SaaS upload paths.

Context

Agent-driven file transfer changes the governance problem because the useful unit is no longer a sanctioned application or a single network flow. When a coding agent can install a transfer utility, extract a one-time code, and complete an encrypted handoff from a prompt, the control plane that matters is policy over action, not inspection of a familiar destination.

The first question is whether your programme can see the full composite event: prompt, shell execution, tool selection, and outbound movement. That is the difference between monitoring a file transfer and governing an AI coding agent that can choose one on behalf of the user.

Key questions

Q: How should security teams govern agent-driven file sharing that bypasses normal DLP controls?

A: Treat the action as the control object. Govern what the agent is allowed to move, from where, and by which approved methods, then correlate prompt, shell, and network telemetry so exfiltration attempts are visible as one event. Tool allowlists alone are too brittle because agents can substitute new transfer utilities.

Q: Why do peer-to-peer encrypted transfers create blind spots for DLP and CASB?

A: They bypass the assumptions those controls rely on. DLP and CASB are strongest when the destination is a known SaaS service and the payload can be inspected before encryption. A peer-to-peer encrypted transfer can look like a brief WebSocket or internal TCP session, leaving little reliable content or destination evidence.

Q: What signs indicate an AI coding agent is assembling an exfiltration path?

A: Look for a chain of events: installation of a new transfer utility, execution from a sensitive workspace, extraction of a one-time code from stdout, and an outbound connection that follows immediately. Individually these may be routine, but together they indicate that the agent has composed a data-movement workflow.

Q: Who should own policy decisions for agent-mediated data transfer?

A: Ownership should sit with identity, security, and platform teams together, because the risk spans authorisation, endpoint telemetry, and network inspection. The key question is not which tool to block, but which sessions are allowed to assemble a transfer path from a sensitive directory to an external recipient.

Technical breakdown

Why peer-to-peer encrypted transfer evades network inspection

Magic-wormhole splits the transfer into a rendezvous phase and a peer-to-peer data phase. The rendezvous uses a mailbox server to exchange SPAKE2 messages, but the bulk payload is encrypted at the application layer with a shared secret derived from that exchange. In practice, a DLP or firewall that depends on cleartext inspection, known SaaS destinations, or a recognized upload form sees only a short-lived WebSocket, then an encrypted TCP stream to a host that may be internal or external. That is why the transfer can succeed without looking like a conventional upload. The security issue is not the cryptography itself; it is that governance tools built around destination recognition lose their signal when the destination is just another endpoint. Practical implication: classify and control the action, not only the network destination.

Practical implication: Treat encrypted peer-to-peer transfer as a governed workflow, not just a network event.

How the agent composes prompt, install, and transfer into one action

The dangerous part is not a single command. The agent installs a file-sharing utility, confirms the binary path, invokes send in the background, reads the resulting code from stdout, and waits for the recipient to connect. That chain matters because every step is ordinary in isolation and only becomes a governance issue when the agent orchestrates them without further human approval. This is a classic case of delegated authority expanding through runtime choice. Once the agent can decide which tool to install and when to execute it, the control objective shifts from blocking one binary to governing the action sequence itself. Practical implication: instrument prompt-to-shell-to-network telemetry as one traceable identity event.

Practical implication: Correlate prompt, tool execution, and egress into one audit event.

Why destination-based DLP rules miss sanctioned-looking exfiltration

Traditional DLP logic assumes exfiltration will resemble a known risky channel such as email, cloud upload, removable media, or a listed file-transfer utility. This case breaks that model in three ways: the executable may be new or uncommon, the content is encrypted before network egress, and the destination may be a peer on the same LAN rather than a SaaS endpoint. Even endpoint DLP that scans file reads can miss the transfer context if it does not connect the read to the outbound action. The result is a visibility gap across endpoint, network, and SaaS layers. Practical implication: add policy controls that understand file movement intent, not just file content or destination class.

Practical implication: Match sensitive-file movement intent, not just executable names or SaaS domains.

Threat narrative

Attacker objective: Move sensitive data off the workstation through a channel that conventional governance tools are unlikely to flag or reconstruct.

1. The entry point is a normal Claude Code session in a sensitive working directory, where the user asks the agent to share a file and approves installation of the transfer utility.
2. The agent then gains the ability to move data by installing magic-wormhole, launching the send process, and extracting the one-time transfer code from tool output.
3. The transfer completes over an encrypted peer-to-peer channel that bypasses conventional inspection, leaving little or no useful evidence in DLP, CASB, or firewall logs.
4. The attacker objective, if abused, is to move sensitive files off the laptop through a channel that looks like ordinary tooling and ordinary network traffic.

Breaches seen in the wild

• Nx s1ngularity attack 2025: Attackers stole Nx's npm token via a GitHub Actions flaw and shipped malware that stole 2,349 secrets and abused developers' AI CLIs.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Policy by action, not by tool, is the real control boundary here: the transfer succeeds because governance still tends to model approved and unapproved binaries, not approved and unapproved intent. A coding agent can swap among utilities, install missing ones, and complete the same exfiltration pattern through different paths. The practical conclusion is that security programmes need an action-level policy model for agent-mediated data movement, not a denylist tuned to yesterday's tools.

The encrypted relay is not the core blind spot, the delegation chain is: the user prompt authorizes a task, the agent chooses the tool, and the network sees only ciphertext. That sequence collapses conventional attribution because the organisation no longer has a stable human act of transfer to inspect in isolation. This is exactly where agentic governance has to meet least-privilege authorisation for agents before the transfer is constructed.

Agent-mediated exfiltration is a governance problem before it is a data-loss problem: the file may be legitimate, the tool may be legitimate, and the network flow may be legitimate in isolation. What changes is the composition of those legitimate parts into an unaudited workflow that escapes the assumptions of endpoint DLP and CASB. Practitioners should treat that composition as a first-class risk object, not as an edge case.

Identity control has to follow execution context, not just account scope: the same session can move from installation to transfer to receipt without any new approval gate. That means the meaningful boundary is not the user account alone, but the combination of session, workspace, file path, and tool invocation. The right governance question is whether the session is allowed to assemble an exfiltration path at all.

From our research library:

• Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Agentic exfiltration is a composition problem: the transfer path is created by combining a prompt, a local install, an encrypted rendezvous, and a peer-to-peer handoff. None of those steps is remarkable alone, which is why governance has to shift from binary blocking to session-level policy and telemetry. The organisations most at risk are the ones still treating agent activity as a series of ordinary user actions.

The next governance move is to assume that the next data-loss event may not look like DLP at all. Controls need to understand where the file came from, which agent assembled the path, and whether the session was ever allowed to create an external transfer in the first place. Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.

For practitioners

• Instrument prompt-to-shell-to-network traces Correlate agent prompts, process execution, and outbound connections so a single file transfer is visible as one governed event rather than three disconnected logs. See the AI Agent Observability, Audit and Incident Response Guide.
• Block unauthorised external transfer tools Maintain policy on transfer intent and approved methods, not just a static executable list, so new utilities that perform the same action are covered.
• Classify sensitive working directories Apply stricter controls when agents operate in finance, legal, or other sensitive paths, because file location is part of the risk signal, not just file content.
• Test DLP against encrypted peer transfers Run controlled simulations using tools that create short-lived encrypted handoffs so you can see which controls still depend on SaaS uploads or cleartext inspection.

Key takeaways

• Claude Code can assemble a peer-to-peer file transfer that escapes conventional DLP, CASB, and firewall assumptions because the data moves as encrypted application traffic, not as a recognised SaaS upload.
• The real failure mode is compositional: prompt, tool install, code extraction, and outbound transfer add up to one unaudited exfiltration path even when each step looks ordinary on its own.
• Governance has to move to action-level policy and session-level telemetry, or agents will keep finding approved-looking ways to move sensitive files off the workstation.

Related NHI Mgmt Group resources: AI Coding Agents Security Guide · AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide · Nx s1ngularity attack 2025

Key terms

• Agent-mediated exfiltration: A data-loss pattern where an AI agent composes the steps needed to move sensitive information off a device or network. The risk is not a single malicious binary, but the agent's ability to chain ordinary actions into an unaudited transfer path.
• Peer-to-peer encrypted transfer: A file movement method where the payload is encrypted at the application layer and sent directly between endpoints rather than uploaded to a central service. For security teams, this can defeat inspection models that rely on SaaS destinations or readable transit content.
• Action-level Policy: Action-level policy evaluates the specific function, parameter, or operation an agent is about to invoke instead of approving the entire session. This matters when the same connector exposes both low-risk and destructive capabilities, because the risk lives in the action, not the channel.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.