Code execution through email: How I used Claude to hack itself
1–10 of 73 posts
Re: Code execution through email: How I used Claude to hack itself
#2Installing malware on your own computer with extra steps?
Re: Code execution through email: How I used Claude to hack itself
#3Installing malware on your own computer with extra steps?
Have you read the article? The source of the attack is an inbound email received in the logged in user's mailbox and read by the logged in user's Claude Desktop app.
Re: Code execution through email: How I used Claude to hack itself
#4Installing malware on your own computer with extra steps?
The point here is that it's easy to do it to someone else who uses Claude in this way just by sending them an email that Claude reads.
Re: Code execution through email: How I used Claude to hack itself
#5Yes, allowing code execution by untrustworthy agents, especially networked ones, is fraught with danger.
Phishing an AI is kind of similar to phishing a smart-ish person...
So remind me again, why does an email scanner need code execution at all?
Re: Code execution through email: How I used Claude to hack itself
#6There is lorem ipsum text when viewed on mobile.
Re: Code execution through email: How I used Claude to hack itself
#7Yes, allowing code execution by untrustworthy agents, especially networked ones, is fraught with danger. Phishing an AI is kind of similar to phishing a smart-ish person... So remind me again, why does an email scanner need code execution at all?
I suspect for plugins that could extend functionality. Think Zapier for email + AI.
Code execution is an optional backend capability for enabling certain workflows
Re: Code execution through email: How I used Claude to hack itself
#8This probably doesn’t need to be currently downloaded malware. If you have a workflow that says go download any file.py via code execution automated workflow in a carefully crafted email after the innocent victim has, in current session, allowed for an email scanner then the Python script will reliably execute and AI would even download it on behalf of the user and run it.
But in this case and maybe others, AI is just a fancy scripting engine by name of LLMs.
Re: Code execution through email: How I used Claude to hack itself
#9Nothing else to expect when giving LLMs system/shell access. Really no suprises here, at all. Works as intended.
Re: Code execution through email: How I used Claude to hack itself
#10> In traditional security, we think in terms of isolated components. In the AI era, context is everything.
In traditional security, everyone knows that attaching a code runner to a source of untrusted input is a terrible idea. AI plays no role in this.
> That’s exactly why we’re building MCP Security at Pynt, to help teams identify dangerous trust-capability combinations, and to mitigate the risks before they lead to silent, chain-based exploits.
This post just an add then?