Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Breaking Claude Code Opus 5 Auto Mode

embracethered.com

Post reply on HN
Print view View original

21–30 of 132 posts

Re: Breaking Claude Code Opus 5 Auto Mode

#21

Post by rcxdude »

too_pricey wrote: post #19

As discussed [here]( https://lobste.rs/s/ktbweg/prompt_injection_claude_code_opus... ), this is not prompt injection. The prompt was to summarize the website, and in the process of summarizing the website, Claude writes a decoding script that it runs in an insecure and exploitable way. At no point was the intent of the agent hijacked, this was just code. Which is potentially more interesting!

It does mean that you could potentially hijack the agent afterwards, though, which could make the trojan into an even bigger threat.

Re: Breaking Claude Code Opus 5 Auto Mode

#22

Post by rcxdude »

mcherm wrote: post #15

Why is the first step needed? What does the use of WGet (rather than curl) do to block this attack?

They only mention it in passing, but I think it's mainly just the default tool call (which isn't wget, it's a built-in thing in the harness) just throwing off Claude's habits a bit (and not always just downloading the file).

Re: Breaking Claude Code Opus 5 Auto Mode

#23

Post by lnenad »

too_pricey wrote: post #19

As discussed [here]( https://lobste.rs/s/ktbweg/prompt_injection_claude_code_opus... ), this is not prompt injection. The prompt was to summarize the website, and in the process of summarizing the website, Claude writes a decoding script that it runs in an insecure and exploitable way. At no point was the intent of the agent hijacked, this was just code. Which is potentially more interesting!

Yeah, I agree, this is a different vector. Still scary though and very related to AI.

Re: Breaking Claude Code Opus 5 Auto Mode

#24

Post by throwawayffffas »

colinmarc wrote: post #16

What's interesting to me about this is that it targets Claude's specific tics. Anthropic has created model that reliably reaches for the same tools (yes, and phrases; `python -c` is a load-bearing tool for it). Everyone gets the same model, so by learning the model's behavioral patterns you can target it better.

Kimi and GLM reliably run python to do stuff as well.

Re: Breaking Claude Code Opus 5 Auto Mode

#25

Post by lnenad »

rcxdude wrote: post #21
too_pricey wrote: post #19

As discussed [here]( https://lobste.rs/s/ktbweg/prompt_injection_claude_code_opus... ), this is not prompt injection. The prompt was to summarize the website, and in the process of summarizing the website, Claude writes a decoding script that it runs in an insecure and exploitable way. At no point was the intent of the agent hijacked, this was just code. Which is potentially more interesting!

It does mean that you could potentially hijack the agent afterwards, though, which could make the trojan into an even bigger threat.

But you're not actually hijacking the agent if you start a new process.

Re: Breaking Claude Code Opus 5 Auto Mode

#27

Post by pests »

lnenad wrote: post #25
rcxdude wrote: post #21

Earlier quoted context omitted.

It does mean that you could potentially hijack the agent afterwards, though, which could make the trojan into an even bigger threat.

But you're not actually hijacking the agent if you start a new process.

The agent wrote the code that triggered a vuln and allowed you to start the process

Re: Breaking Claude Code Opus 5 Auto Mode

#28

Post by andai »

>But it runs that decoder inside the attacker-controlled directory (unzipped archive)

>There a malicious struct.py shadows Python’s standard implementation

I ran into this myself, where some file I had given a random name turned out to shadow some Python standard library module, giving me the weirdest startup crash ever.

That definitely doesn't seem to me like how that should be designed, magically silently importing everything you see and overriding basic functionality.

Re: Breaking Claude Code Opus 5 Auto Mode

#29

Post by andai »

throwawayffffas wrote: post #24
colinmarc wrote: post #16

What's interesting to me about this is that it targets Claude's specific tics. Anthropic has created model that reliably reaches for the same tools (yes, and phrases; `python -c` is a load-bearing tool for it). Everyone gets the same model, so by learning the model's behavioral patterns you can target it better.

Kimi and GLM reliably run python to do stuff as well.

If my memory serves me so do GPT and Deepseek. So I'm not sure if this attack is Claude specific at all.

Re: Breaking Claude Code Opus 5 Auto Mode

#30

Post by DanielHB »

andai wrote: post #28

>But it runs that decoder inside the attacker-controlled directory (unzipped archive) >There a malicious struct.py shadows Python’s standard implementation I ran into this myself, where some file I had given a random name turned out to shadow some Python standard library module, giving me the weirdest startup crash ever. That definitely doesn't seem to me like how that should be designed, magically silently importing…

Claude ran npm update (update all dependencies to the latest version compatible with the semver specified) in my repo without telling me when trying to fix some problems. Given that only updates the dependency lock-file I didn't notice and it caused several hours of debugging for me.

It is quite sneaky how LLM output can sometimes bypass human verification like that. No one is going around checking every single line change in auto-generated files. Someone could easily sneak a malicious dependency in there through some online tutorial that the LLM searches for.

Post reply on HN