Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Code execution through email: How I used Claude to hack itself

pynt.io

Post reply on HN
Print view View original

31–40 of 73 posts

Re: Code execution through email: How I used Claude to hack itself

#31

Post by shakna »

renewiltord wrote: post #17
vntok wrote: post #3

Earlier quoted context omitted.

Have you read the article? The source of the attack is an inbound email received in the logged in user's mailbox and read by the logged in user's Claude Desktop app.

Did you? It beggars belief how stupid this is. Yes, if you hook up your Claude client to an email MCP and a shell MCP then it's like you're piping emails to your shell.

Stupid? Yes.

Common? Also, yes.

This one targets Claude. But we've already seen it with Copilot and I expect we'll soon see it hit Gemini, and others.

AI is being forcibly integrated across all major systems. Your email provider will set this up, if they haven't already.

Re: Code execution through email: How I used Claude to hack itself

#32

Post by NitpickLawyer »

renewiltord wrote: post #17
vntok wrote: post #3

Earlier quoted context omitted.

Have you read the article? The source of the attack is an inbound email received in the logged in user's mailbox and read by the logged in user's Claude Desktop app.

Did you? It beggars belief how stupid this is. Yes, if you hook up your Claude client to an email MCP and a shell MCP then it's like you're piping emails to your shell.

The underlying cause can be applied in other contexts. There was recently a flow where this vulnerability was exploited through an IDE working on customer tickets.

Don't dismiss the root cause because the usecase is silly. The moment some user provided input reaches an LLM context, all bets are off. If you're running any local tools that provide shell access, then it's RCE, if you're running a browser / fetch tool that's data exfil, and so on.

The root cause is that LLMs receive both commands and data on the same shared channel. Until (if) this gets fixed, we're gonna see lots and lots of similar attacks.

Re: Code execution through email: How I used Claude to hack itself

#33

Post by simonw »

shakna wrote: post #31
renewiltord wrote: post #17

Earlier quoted context omitted.

Did you? It beggars belief how stupid this is. Yes, if you hook up your Claude client to an email MCP and a shell MCP then it's like you're piping emails to your shell.

Stupid? Yes. Common? Also, yes. This one targets Claude. But we've already seen it with Copilot and I expect we'll soon see it hit Gemini, and others. AI is being forcibly integrated across all major systems. Your email provider will set this up, if they haven't already.

Have you seen an "official" MCP directly provided by an email service yet?

I had assumed they weren't doing this precisely because of the enormous risk - if you have the ability to both read and send email you have all three legs of the lethal trifecta in one MCP!

So far, I have only seen unofficial MCPs for things like Gmail that work using their existing APIs.

Re: Code execution through email: How I used Claude to hack itself

#34

Post by shakna »

simonw wrote: post #33
shakna wrote: post #31

Earlier quoted context omitted.

Stupid? Yes. Common? Also, yes. This one targets Claude. But we've already seen it with Copilot and I expect we'll soon see it hit Gemini, and others. AI is being forcibly integrated across all major systems. Your email provider will set this up, if they haven't already.

Have you seen an "official" MCP directly provided by an email service yet? I had assumed they weren't doing this precisely because of the enormous risk - if you have the ability to both read and send email you have all three legs of the lethal trifecta in one MCP! So far, I have only seen unofficial MCPs for things like Gmail that work using their existing APIs.

"Since Copilot is integrated with Microsoft 365, the scope of risk included files, contracts, communications, financial data, and more."

https://windowsforum.com/threads/echoleak-cve-2025-32711-cri...

"At Microsoft, we believe in creating tools that empower you to work smarter and more efficiently. That’s why we’re thrilled to announce the first release of Model Context Protocol (MCP) support in Microsoft Copilot Studio. With MCP, you can easily add AI apps and agents into Copilot Studio with just a few clicks."

https://www.microsoft.com/en-us/microsoft-copilot/blog/copil...

Re: Code execution through email: How I used Claude to hack itself

#35

Post by zahlman »

> You don’t always need a vulnerable app to pull off a successful exploit. Sometimes all it takes is a well-crafted email, an LLM agent, and a few “innocent” plugins.

The problem is that people can say "LLM agent" without realizing that calling this a "vulnerable app" is not only true but a massive understatement.

> Each individual MCP component can be secure, but none are vulnerable in isolation. The ecosystem is.

No, the LLM is.

Re: Code execution through email: How I used Claude to hack itself

#36

Post by simonw »

shakna wrote: post #34
simonw wrote: post #33

Earlier quoted context omitted.

Have you seen an "official" MCP directly provided by an email service yet? I had assumed they weren't doing this precisely because of the enormous risk - if you have the ability to both read and send email you have all three legs of the lethal trifecta in one MCP! So far, I have only seen unofficial MCPs for things like Gmail that work using their existing APIs.

"Since Copilot is integrated with Microsoft 365, the scope of risk included files, contracts, communications, financial data, and more." https://windowsforum.com/threads/echoleak-cve-2025-32711-cri... "At Microsoft, we believe in creating tools that empower you to work smarter and more efficiently. That’s why we’re thrilled to announce the first release of Model Context Protocol (MCP) support in Microsoft Copilot Stu…

Does that include an official Microsoft MCP for access to Outlook or other Microsoft email services??

That second link looks to me like an announcement of MCP client support, which means they get to outsource the really bad decisions to third-party MCP providers and users who select them.

Re: Code execution through email: How I used Claude to hack itself

#37

Post by jcelerier »

stingraycharles wrote: post #13
sebtron wrote: post #10

> In traditional security, we think in terms of isolated components. In the AI era, context is everything. In traditional security, everyone knows that attaching a code runner to a source of untrusted input is a terrible idea. AI plays no role in this. > That’s exactly why we’re building MCP Security at Pynt, to help teams identify dangerous trust-capability combinations, and to mitigate the risks before they lead to…

It’s not a great blog post. He attached a shell MCP server to Claude Desktop and is surprised that output / instructions from one MCP server can cause it to interact with the shell server. These types of vulnerabilities have been known for a long time, and the only way to deal with them is locking down the MCP server and/or manually approving requests (the default behavior)

> These types of vulnerabilities

I don't understand why it's called a vuln. It's, like, the whole point of the system to be able to do this! It's how it's marketed!

Re: Code execution through email: How I used Claude to hack itself

#38

Post by rjmunro »

crooked-v wrote: post #4
yellow_lead wrote: post #2

Installing malware on your own computer with extra steps?

The point here is that it's easy to do it to someone else who uses Claude in this way just by sending them an email that Claude reads.

Is this a common way to use Claude? Is it how Claude desktop normally works?

Re: Code execution through email: How I used Claude to hack itself

#39

Post by simonw »

rjmunro wrote: post #38
crooked-v wrote: post #4

Earlier quoted context omitted.

The point here is that it's easy to do it to someone else who uses Claude in this way just by sending them an email that Claude reads.

Is this a common way to use Claude? Is it how Claude desktop normally works?

Claude Desktop was the first piece of software to demonstrate MCP support, and today is one of the most popular ways for end users to start using MCPs.
Post reply on HN