Elastic Security Detection Rules

Anthropic Artifact Shared Publicly

Last updated 4 days ago on 2026-09-21
Created 13 days ago on 2026-09-12

About

Claude artifacts can be shared with specific audiences. Making an artifact public exposes its contents to unauthenticated viewers on the internet. An attacker with access to sensitive artifacts can publish them publicly to push intellectual property, credentials embedded in prompts, or other confidential material outside organizational controls.
Tags
Domain: GenAIPlatform: AnthropicData Source: Anthropic Audit LogsUse Case: Threat DetectionRule Type: ES|QLTactic: ExfiltrationLanguage: esql
Severity
medium
Risk Score
47
MITRE ATT&CK™

Exfiltration (TA0010)(external, opens in a new tab or window)

↳ Exfiltration Over Web Service (T1567)(external, opens in a new tab or window)

False Positive Examples
Users publish artifacts intentionally for demos, documentation, or external collaboration. Validate the artifact, actor, and business justification before escalating.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Integration Pack
Prebuilt Security Detection Rules
Related Integrations

anthropic(external, opens in a new tab or window)

Query
text code block:
from logs-anthropic.audit-* metadata _id, _version, _index
| where
    data_stream.dataset == "anthropic.audit" and
    mv_contains(event.category, "configuration") and
    event.action == "claude_artifact_sharing_updated"
| eval Esql.audience_types = FIELD_EXTRACT(anthropic.audit.audience, "type")
| where Esql.audience_types is not null and mv_contains(Esql.audience_types, "anyone_with_link")
| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*, Esql.audience_types

Install detection rules in Elastic Security

Detect Anthropic Artifact Shared Publicly in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).