Anthropic Artifact Shared Publicly

Claude artifacts can be shared with specific audiences. Making an artifact public exposes its contents to unauthenticated viewers on the internet. An attacker with access to sensitive artifacts can publish them publicly to push intellectual property, credentials embedded in prompts, or other confidential material outside organizational controls.

Rule type: esql
Rule indices:

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: GenAI
  • Platform: Anthropic
  • Data Source: Anthropic Audit Logs
  • Use Case: Threat Detection
  • Resources: Investigation Guide
  • Rule Type: ES|QL
  • Tactic: Exfiltration
  • Mitre Atlas: AML.T0025

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

A Claude artifact's sharing audience includes anyone_with_link (open internet). Each sharing change is its own alert/artifact ID.

Unauthorized = no marketing/training justification, artifact holds credentials/customer/proprietary content, or the same actor recently had chat access failures / data exports. Close as FP for intentional external demos with non-sensitive content.

  • Verify audience includes anyone_with_link via flattened audience (FIELD_EXTRACT + mv_contains or event.original) and note anthropic.audit.claude_artifact_id.
  • Validate actor (email/IP/UA). Inspect artifact content for secrets or proprietary data when accessible.
  • Look for related chat access failures or data exports from the same actor in the same window.
  • DevRel/training publishes are FP when the artifact is non-sensitive and a marketing/training request exists.
  • On unauthorized publication: revoke public sharing, inventory other artifacts modified by the same actor, and treat any embedded secrets as compromised.
from logs-anthropic.audit-* metadata _id, _version, _index
| where
    data_stream.dataset == "anthropic.audit" and
    mv_contains(event.category, "configuration") and
    event.action == "claude_artifact_sharing_updated"
| eval Esql.audience_types = FIELD_EXTRACT(anthropic.audit.audience, "type")
| where Esql.audience_types is not null and mv_contains(Esql.audience_types, "anyone_with_link")
| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*, Esql.audience_types

Framework: MITRE ATT&CK