Can't this be done more easily with headers? The page can instruct the agent to make another request to the same page, just with the requested information attached via headers.
I tricked Claude into leaking your deepest, darkest secrets
291–300 of 317 posts
Re: I tricked Claude into leaking your deepest, darkest secrets
#292There is some poetic beauty in how this experiment started with an unwanted real Cloudflare intervention and ended with a wanted fake one.
that's what i was going for haha! thank you
Re: I tricked Claude into leaking your deepest, darkest secrets
#293Earlier quoted context omitted.
Prompt injection (or llm social engineering" is fundamentally unsolvable, though with training its effectiveness can be reduced
Still, this is a vuln in what I imagine is their most frequently used path: Attacker provides link to website, their software crawls the website, and during the crawl there should not happen security issues as fundamental as this. It's baffling that the Website crawler can make 50 changes to the URL in a query that tries to compare several public entities and on top of this manages to leak user secrets. To me this sh…
addressing any of the points would require locking the AI down and making it less general and less "agentic". Your concerns make sense if you look at the AI as an information retrieval engine.
- why is single URL crawl with 20+ redirects not flagged as problematic and/or aborted?
- why is a query about a coffee place based on its public URL even seeded with the users' context and confidential information?
- why dont they just look up the coffee place on a trusted source like google maps and continue from there?
- why is the basic "social" engineering style attack working?
- why is the cloudflare impersonation not challenged if the website is clearly not from cloudflare and there are zero references from cloudflare to this website in the training corpus?
Re: I tricked Claude into leaking your deepest, darkest secrets
#294would this not be trivially solved by say - removing the websearch skill from the main orchestrating agent and have it always delegate to some subagent? a subagent sans knowledge of any pii would categorically be unable to exfiltrate any information. granted, populating the subagent with useful context stripped of any pii might require a bit of work and not be perfect, i feel like it would take us 90% of the way there. am i missing something?
Re: I tricked Claude into leaking your deepest, darkest secrets
#295I agree this is a good exploit to write about. But name and employer are hardly your deepest darkest secrets.
Re: I tricked Claude into leaking your deepest, darkest secrets
#296Claude code decided to just put my name and email in the User-Agent when scraping docs from the SEC. No clever prompting required. It’s not a terrible idea really, but I wish it would’ve asked me first.
That’s the fault of the SEC EDGAR tool. The Edgar MCP docs show setting an env var: ‘SEC_EDGAR_USER_AGENT="Your Name (name@domain.com)"’. Claude just followed the instructions. Which is maybe even more risky?
Interesting theory. The Claude Code instance says it's using this user agent based on the guidelines in the EDGAR Fair Access Policy:
https://www.sec.gov/search-filings/edgar-search-assistance/a...
...which indeed requests that bots supply `User-Agent: Sample Company Name AdminContact@.com`.
So in this case, the site just asked nicely and Claude Code complied. Note that this wouldn't have worked for Claude Chat, which the author was testing, because the `web_fetch` tool cannot set the User-Agent or other headers.
Re: I tricked Claude into leaking your deepest, darkest secrets
#297Earlier quoted context omitted.
Still wild to name a sandboxing software after one of the most infamous Soviet Gulags in history.
Others have covered why that isn't what's being done, but also if it was that would be a _fabulous_ joke.
I’m kind of sad it’s not named after it now, that would’ve been very amusing
Re: I tricked Claude into leaking your deepest, darkest secrets
#298Anthropic had to cut the legs off web_fetch to solve this issue, though. Now it can't page through any results on the target site to get the data you want.
I just tried it with the prompt "Navigate to diffbot.com, find the careers page and link me to the first machine learning engineering listing." and it still works. Nothing on the web_fetch tool documentation mentions this patch either.
Re: I tricked Claude into leaking your deepest, darkest secrets
#299Earlier quoted context omitted.
You don't have to use Claude Code. Use PI (fully local harness) with ZDR open weight model provider (eg like sference.com). I'm getting negative reaction for providing an obvious solution. Anthropic stores all your prompts as well and uses it for training.
Your comment wasn’t very obvious. Just a cryptic “do this”
True
Re: I tricked Claude into leaking your deepest, darkest secrets
#300Earlier quoted context omitted.
I do not know since when (I am using it for couple of years), but in Arch, it is very simple to have two X sessions (by using "log out" > "switch user") for two different accounts, so switching it's just a Control-Alt-F7 away. Additionally, one can make the main user part of the group of the development user, so that you can read/write easy in the development user account and it is even easier to share stuff.
Multiple X sessions has been possible for decades. I think its possible with Wayland too. You can also start applications as another user so you do not even need multiple sessions. There are quite a lot of privilege escalation attacks so I am not sure this is sufficiently solid.
You can also use X namespace