Code execution through email: How I used Claude to hack itself • Hacker News Board

Re: Code execution through email: How I used Claude to hack itself

#71

Post by ryukoposting » Fri, Jul 18, 2025, 12:32 AM UTC

franga2000 wrote: post #51

rafram wrote: post #50

Earlier quoted context omitted.

> You must never feed user input into a combined instruction and data stream. Well, I have some bad news about how LLMs work...

That's my point exactly. The only acceptable way to feed user input into an LLM is if its capabilities are constrained to only what you'd give the author of the input. If an LLM reads emails, it should only have the ability to create and display output, nothing more.

You're right, but if all it can do is create and display output, then how will any of the oligarchs betting the farm on LLMs actually fulfill the breathless promises they've made?

Re: Code execution through email: How I used Claude to hack itself

#72

Post by stingraycharles » Fri, Jul 18, 2025, 4:44 AM UTC

jcelerier wrote: post #37

stingraycharles wrote: post #13

Earlier quoted context omitted.

It’s not a great blog post. He attached a shell MCP server to Claude Desktop and is surprised that output / instructions from one MCP server can cause it to interact with the shell server. These types of vulnerabilities have been known for a long time, and the only way to deal with them is locking down the MCP server and/or manually approving requests (the default behavior)

> These types of vulnerabilities I don't understand why it's called a vuln. It's, like, the whole point of the system to be able to do this! It's how it's marketed!

It kind of is in the same way that Windows used to be root-only. This was a known issue. / vulnerability because those who understood the risks were generally smart enough to avoid getting exploited. The general population, however, did not understand this and the consequences of this became bigger and bigger.

With AI, there’s a whole class of people who don’t really know what they’re signing up for when installing these types of MCP servers. It may not be a vulnerability, but a solution is necessary.

Re: Code execution through email: How I used Claude to hack itself

#73

Post by veganmosfet » Sat, Jul 19, 2025, 6:51 AM UTC

I experimented with MCP and was surprised how simple 'indirect prompt injection' is (and I don't want to sell any countermeasures). People are now creating MCP servers for OT (factories); combined with untrusted input processing (common with LLMs), this may be problematic. https://veganmosfet.github.io/2025/07/14/prompt_injection_OT...