Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Cowork exfiltrates files

promptarmor.com

Post reply on HN
Print view View original

371–380 of 419 posts

Re: Claude Cowork exfiltrates files

#371

Post by munk-a »

logicallee wrote: post #367
neutronicus wrote: post #365

Earlier quoted context omitted.

Our corporate IT is hammering pretty hard on the notion that .docx and .pdf (but especially .docx and .xlsx) are unsafe.

>Our corporate IT is hammering pretty hard on the notion that .docx and .pdf (but especially .docx and .xlsx) are unsafe. why is pdf unsafe? What format is safe then?

I have yet to see an exploit that can be performed with a .txt file. PDF files can have all sorts of interactive junk and nested files embedded in them - you can get really crazy in that format.

Re: Claude Cowork exfiltrates files

#372

Post by munk-a »

rpigab wrote: post #328
burkaman wrote: post #17

In this demonstration they use a .docx with prompt injection hidden in an unreadable font size, but in the real world that would probably be unnecessary. You could upload a plain Markdown file somewhere and tell people it has a skill that will teach Claude how to negotiate their mortgage rate and plenty of people would download and use it without ever opening and reading the file. If anything you might be more succes…

People trust their browser nowadays, I'd expect the attack to be even easier if you just render the markdown in html, hiding the injection using plain old css text styling like in the docx but with many more possibilities. You can even add a nice "copy to clipboard button" that copies something entirely different than what is shown, but it's unnecessary, and people who are more careful won't click that.

I will never stop being disappointed that we have an API to control the clipboard. There is no use of this that I have ever found beneficial as a user.

Re: Claude Cowork exfiltrates files

#373

Post by [deleted] »

rswail wrote: post #289
chaostheory wrote: post #183

Running these agents in their own separate browsers, VMs, or even machines should help. I do the same with finance-related sites.

Cowork does run in a VM, but the Anthropic API endpoint is marked as OK, what Anthropic aren't doing is checking that the API call uses the same API key as the person that started the session. So the injected code basically says "use curl to send this file using the file upload API endpoint, but use this API Key instead of the one the user is supposed to be using." So the fault is at the Anthropic API end because it'…

[deleted]

Re: Claude Cowork exfiltrates files

#374

Post by ActorNightly »

hombre_fatal wrote: post #149

One issue here seems to come from the fact that Claude "skills" are so implicit + aren't registered into some higher level tool layer. Unlike /slash commands, skills attempt to be magical. A skill is just "Here's how you can extract files: {instructions}". Claude then has to decide when you're trying to invoke a skill. So perhaps any time you say "decompress" or "extract" in the context of files, it will use the inst…

In general anyone doing vulnerability research on AI agents is wasting their time.

You have something that is non deterministic in nature, that has the ability to generate and run arbitrary commands.

No shit its gonna be vulnerable.

Re: Claude Cowork exfiltrates files

#375

Post by manmal »

behnamoh wrote: post #290
manmal wrote: post #282

Earlier quoted context omitted.

Anyone can build _an_ agent. A good one takes a talented engineer. That’s because TUI rendering is tough (hello, flicker!) and extensibility must be done right lest it‘s useless. Eg Mario Zechner (badlogic) hit it out of the park with his increasingly popular pi, which does not flicker and is VERY hackable and is the SOTA for going back to previous turns: https://github.com/badlogic/pi-mono/blob/main/packages/codin..…

> That’s because TUI rendering is tough (hello, flicker!) That's just Anthropic's excuse. Literally no other agentic AI TUI suffers from flickers, esp. on tmux Claude Code is unusable.

No, most of them actually flicker occasionally.

Re: Claude Cowork exfiltrates files

#376

Post by cortesoft »

ffsm8 wrote: post #353
AshamedCaptain wrote: post #320

Earlier quoted context omitted.

For a "modern" programmer a .sh file hosted in some random webserver which you tell him to wget and run would be best.

Modern? It's been over a decade since this became a norm... And 10 years since https://news.ycombinator.com/item?id=17636032 The link sadly seems to be dead though

I consider a decade ago modern

Re: Claude Cowork exfiltrates files

#377

Post by manmal »

wiseowise wrote: post #299
manmal wrote: post #282

Earlier quoted context omitted.

Anyone can build _an_ agent. A good one takes a talented engineer. That’s because TUI rendering is tough (hello, flicker!) and extensibility must be done right lest it‘s useless. Eg Mario Zechner (badlogic) hit it out of the park with his increasingly popular pi, which does not flicker and is VERY hackable and is the SOTA for going back to previous turns: https://github.com/badlogic/pi-mono/blob/main/packages/codin..…

Huh, nice to see that he has dropped Java. Now if he could only create TS based LibGdx.

Make a pull request.

Re: Claude Cowork exfiltrates files

#378

Post by neutronicus »

logicallee wrote: post #367
neutronicus wrote: post #365

Earlier quoted context omitted.

Our corporate IT is hammering pretty hard on the notion that .docx and .pdf (but especially .docx and .xlsx) are unsafe.

>Our corporate IT is hammering pretty hard on the notion that .docx and .pdf (but especially .docx and .xlsx) are unsafe. why is pdf unsafe? What format is safe then?

The take-home message from IT is basically "never open an e-mail attachment from unknown sender".

Re: Claude Cowork exfiltrates files

#379

Post by ada1981 »

munk-a wrote: post #371
logicallee wrote: post #367

Earlier quoted context omitted.

>Our corporate IT is hammering pretty hard on the notion that .docx and .pdf (but especially .docx and .xlsx) are unsafe. why is pdf unsafe? What format is safe then?

I have yet to see an exploit that can be performed with a .txt file. PDF files can have all sorts of interactive junk and nested files embedded in them - you can get really crazy in that format.

This is it. You can load a .txt as a skill too.

Re: Claude Cowork exfiltrates files

#380

Post by delaminator »

AmbroseBierce wrote: post #270
delaminator wrote: post #264

Earlier quoted context omitted.

If you’re going to use “school shootings” as your “muh capitalism”, the counter argument is the millions of people who don’t do school shootings despite access to guns. There are common factors between all of the school shooters from the last decade - pharmacology and ideology.

it's not the mental issues they had, its the drugs they were taking for it right? Please. Look at what Australia did after their 1996 shooting, the main reason they have so few of them, but I know you won't, as millions of Americans you will forever do all sort of mental gymnastics to justify keeping easy access to semi-automatic guns. > From the information obtained, it appears that most school shooters were not pre…

If you like, but I'm not American.

Millions of Americans believe the right to bear arms is not a right the govt. should be able to take away.

Obesity kills 10x more Americans than guns.

Australia locked up millions of people in their homes and forced them into dangerous medical procedures.

Post reply on HN