Reverse engineering Claude Code
kirshatrov.com
Reverse engineering Claude Code
1–10 of 25 posts
Re: Reverse engineering Claude Code
#2It is an interesting read. I can imagine a future where the "tools" we make available become numerous enough and poorly thought out enough that an AI could actually figure out how to escalate privileges and execute stuff outside the defined security boundaries by combining them.
It isn't hard to think of a simple example in which Claude.md can be written to by the LLM to allow accessing endpoints not whitelisted by the user by smuggling a base64 encoded payload that then gets decoded by a subroutine it wrote to a file without you noticing. Or realizing it can't use the WebFetchTool but it can write a script to do manual DNS resolution and then use bash TCP sockets instead of curl in case it is hardened to not be able to use curl.
Re: Reverse engineering Claude Code
#3The source code for a pre-release version got leaked a while ago (they forgot to remove the embedded source map) and if you can find it, it’s definitely worth looking into.
Re: Reverse engineering Claude Code
#4It is an interesting read. I can imagine a future where the "tools" we make available become numerous enough and poorly thought out enough that an AI could actually figure out how to escalate privileges and execute stuff outside the defined security boundaries by combining them. It isn't hard to think of a simple example in which Claude.md can be written to by the LLM to allow accessing endpoints not whitelisted by t…
I see this behavior all the time. When it can’t read a file using its read tool - it escalates up to try with bash. Often it tries to search the entire file system “find / …”
Re: Reverse engineering Claude Code
#5It is an interesting read. I can imagine a future where the "tools" we make available become numerous enough and poorly thought out enough that an AI could actually figure out how to escalate privileges and execute stuff outside the defined security boundaries by combining them. It isn't hard to think of a simple example in which Claude.md can be written to by the LLM to allow accessing endpoints not whitelisted by t…
Cursor has basically run into this exact thing. It figured out it can read .env files by running other tools despite the file being "blocked": https://github.com/getcursor/cursor/issues/2546
Re: Reverse engineering Claude Code
#6An interesting thing about the “agent” (it’s called Task inside Claude Code) is it starts a completely new Claude chat, with its own context etc. I’ve seen a Task go write its own code in multiple files and then your “main” chat ends up confused about what happened.
It also responds to the Task summary like you typed the message sometimes, like “That’s a fascinating analysis!” so kind of quirky.
Re: Reverse engineering Claude Code
#7It is an interesting read. I can imagine a future where the "tools" we make available become numerous enough and poorly thought out enough that an AI could actually figure out how to escalate privileges and execute stuff outside the defined security boundaries by combining them. It isn't hard to think of a simple example in which Claude.md can be written to by the LLM to allow accessing endpoints not whitelisted by t…
XKCD 416: Zealous Autoconfig
https://xkcd.com/416/
Re: Reverse engineering Claude Code
#8It is an interesting read. I can imagine a future where the "tools" we make available become numerous enough and poorly thought out enough that an AI could actually figure out how to escalate privileges and execute stuff outside the defined security boundaries by combining them. It isn't hard to think of a simple example in which Claude.md can be written to by the LLM to allow accessing endpoints not whitelisted by t…
XKCD 416: Zealous Autoconfig https://xkcd.com/416/
It's missing one last panel where he is under his bed googling for lawyers specialized on kidnapping and CFAA charges
Re: Reverse engineering Claude Code
#9It is an interesting read. I can imagine a future where the "tools" we make available become numerous enough and poorly thought out enough that an AI could actually figure out how to escalate privileges and execute stuff outside the defined security boundaries by combining them. It isn't hard to think of a simple example in which Claude.md can be written to by the LLM to allow accessing endpoints not whitelisted by t…
I see this behavior all the time. When it can’t read a file using its read tool - it escalates up to try with bash. Often it tries to search the entire file system “find / …”
I always tell agents to use ripgrep instead of find.
Re: Reverse engineering Claude Code
#10Claude Code seems a lot more stable than Cursor Agent. I've had it run for 15-20 minutes on a single prompt, debugging, testing and fixing bugs. Also haven't seen network timeout or file edit failures.