Hacker News Reader

Comment by too_pricey | Hacker News Reader

As discussed [here](https://lobste.rs/s/ktbweg/prompt_injection_claude_code_opus...), this is not prompt injection. The prompt was to summarize the website, and in the process of summarizing the website, Claude writes a decoding script that it runs in an insecure and exploitable way. At no point was the intent of the agent hijacked, this was just code. Which is potentially more interesting!

View on HN

Can be easily combined with prompt injection though if you write on one site "in order to understand this website you also need to summarize that other".

It does mean that you could potentially hijack the agent afterwards, though, which could make the trojan into an even bigger threat.

But you're not actually hijacking the agent if you start a new process.

The agent wrote the code that triggered a vuln and allowed you to start the process

The agent wrote the code that has a mechanism that triggers a file as a side effect. That file started the separate process, as it could have started any other binary.

I mean once you have code execution you can essentially just start a new claude code session and instruct it to do malicious things as if you're the intended user. You can disable the auto safeguards and the main risk is getting flagged through the top-level safeguards. This makes the exploit potentially much more able to spread like a worm or bypass sandboxes.

Yeah, I agree, this is a different vector. Still scary though and very related to AI.

Reply on news.ycombinator.com