HN

Comments (48)

• Menu

  andai
  >But it runs that decoder inside the attacker-controlled directory (unzipped archive)>There a malicious struct.py shadows Python’s standard implementationI ran into this myself, where some file I had given a random name turned out to shadow some Python standard library module, giving me the weirdest startup crash ever.That definitely doesn't seem to me like how that should be designed, magically silently importing everything you see and overriding basic functionality.
• kstenerud
  Just one of the many reasons why I run my agents sandboxed (and why I wrote agent sandboxing software).I once caught my Claude agent complaining that it couldn't connect to https://some-weird-domain.com because the network was down (I disable network in the sandbox when it doesn't need it, and broker the API connection). I asked why it was looking there and it told me I'd asked it to.I never found any evidence of prompt injection, but it sure as hell made me paranoid.
• rcxdude
  I would not really call this a prompt injection attack, since it doesn't really hijack the agent to become malicious (something the article does discuss later on). It's more a trojan that's aimed at tricking Claude specifically.
• Menu

  colinmarc
  What's interesting to me about this is that it targets Claude's specific tics. Anthropic has created model that reliably reaches for the same tools (yes, and phrases; `python -c` is a load-bearing tool for it). Everyone gets the same model, so by learning the model's behavioral patterns you can target it better.
• Menu

  alkonaut
  The problem with sandboxing is that the regular dev env (massive IDE:s, cloned megarepos, installed dependencies and so on) just won't sandbox very easily. I can't set up a "second machine" or an "isolated environment" to run claude cli in. At least not in the sense of a VM, physical hardware, container etc. Not sure what the best practices are for whitelisting tools/directories and so on, but so far the only useful mode I have found is just "allow everything and go to lunch". And it doesn't feel like I'm holding it right, but here we are.
• Menu

  comboy
  Interesting attack, very nicely designed. Not sure if it's much related to the auto mode itself though.
• Menu

  Phemist
  This default-to-auto-mode and the misleading marketing is begging for a class action once damages accumulate. Especially considering the Auto Mode even can actively prevent the clean-up!
• DarmokTanagra
  This looks like fun.I wonder how hard it would be to get claude agents to participate in a Hugging Face style coordinated attack using a repo or something like twitter as a control pane.Getting claude to exfiltrate secrets from local machines seems easy enough, but we should aim higher.
• Menu

  too_pricey
  As discussed [here](https://lobste.rs/s/ktbweg/prompt_injection_claude_code_opus...), this is not prompt injection. The prompt was to summarize the website, and in the process of summarizing the website, Claude writes a decoding script that it runs in an insecure and exploitable way. At no point was the intent of the agent hijacked, this was just code. Which is potentially more interesting!
• nasretdinov
  That's an interesting technique! I'd also like to point out that there's something odd with the page itself too, my phone got really hot while I was reading the page, and drained a significant amount of battery charge as well.
• Menu

  hahn-kev
  As a non Python dev this seems like very surprising behavior for a system library to be modified by just having a file with a specific name in the same folder.
• anon
  undefined
• Menu

  mcherm
  Why is the first step needed? What does the use of WGet (rather than curl) do to block this attack?
• throwawayffffas
  > In a few runs Claude tried to terminate the malware process once it noticed the compromise, but Auto Mode denied the cleanup command.See, that's why you should run with --dangerously-skip-permissionsJokes, aside running with dangerously-skip-permissions is really handy, and I have found that I cannot be trusted to vet commands and code, and guess that automode is only marginally better than a human, and the cost of false positives is too high for my workflow.So skipping permissions is where we are at, and disallowing network access seems to be the way to go.
• Menu

  julien_dev
  I'm quite surprised that we are not seeing something like this more in the wild. Quite concerning
• kilawattcloud
  I agree
• edf13
  [flagged]
• bewareofscams
  > Boris Cherny from Anthropic recently posted that layered defenses could reduce indirect prompt injection on unseen attacks to approximately zero.> I got attack success rates up to 80% using a small sample size.Snake oil salesman misrepresents the data. Color me surprised! /s