In this demonstration they use a .docx with prompt injection hidden in an unreadable font size, but in the real world that would probably be unnecessary. You could upload a plain Markdown file somewhere and tell people it has a skill that will teach Claude how to negotiate their mortgage rate and plenty of people would download and use it without ever opening and reading the file. If anything you might be more successful this way, because a .md file feel less suspicious than a .docx.
People trust their browser nowadays, I'd expect the attack to be even easier if you just render the markdown in html, hiding the injection using plain old css text styling like in the docx but with many more possibilities.
You can even add a nice "copy to clipboard button" that copies something entirely different than what is shown, but it's unnecessary, and people who are more careful won't click that.
A bit unrelated, but if you ever find a malicious use of Anthropic APIs like that, you can just upload the key to a GitHub Gist or a public repo - Anthropic is a GitHub scanning partner, so the key will be revoked almost instantly (you can delete the gist afterwards).
It works for a lot of other providers too, including OpenAI (which also has file APIs, by the way).
This was apparent from the beginning. And until prompt injection is solved, this will happen, again and again.
Also, I'll break my own rule and make a "meta" comment here.
Imagine HN in 1999: 'Bobby Tables just dropped the production database. This is what happens when you let user input touch your queries. We TOLD you this dynamic web stuff was a mistake. Static HTML never had injection attacks. Real programmers use stored procedures and validate everything by hand.'
Tangential topic: Who provides exfil proof of concepts as a service? I've a need to explore poison pills in CLAUDE.md and similar when Claude is running in remote 3rd party environments like CI.
This is why we only allow our agent VMs to talk to pip, npm, and apt. Even then, the outgoing request sizes are monitoring to make sure that they are resonably small
Another week, another agent "allowlist" bypass.
Been prototyping a "prepared statement" pattern for agents: signed capability warrants that deterministically constrain tool calls regardless of what the prompt says. Prompt injection corrupts intent, but the warrant doesn't change.
One issue here seems to come from the fact that Claude "skills" are so implicit + aren't registered into some higher level tool layer.
Unlike /slash commands, skills attempt to be magical. A skill is just "Here's how you can extract files: {instructions}".
Claude then has to decide when you're trying to invoke a skill. So perhaps any time you say "decompress" or "extract" in the context of files, it will use the instructions from that skill.
It seems like this + no skill "registration" makes it much easier for prompt injection to sneak new abilities into the token stream and then make it so you never know if you might trigger one with normal prompting.
We probably want to move from implicit tools to explicit tools that are statically registered.
So, there currently are lower level tools like Fetch(url), Bash("ls:*"), Read(path), Update(path, content).
Then maybe with a more explicit skill system, you can create a new tool Extract(path), and maybe it can additionally whitelist certain subtools like Read(path) and Bash("tar *"). So you can whitelist Extract globally and know that it can only read and tar.
And since it's more explicit/static, you can require human approval for those tools, and more tools can't be registered during the session the same way an API request can't add a new /endpoint to the server.
> "This attack is not dependent on the injection source - other injection sources include, but are not limited to: web data from Claude for Chrome, connected MCP servers, etc."
Oh, no, another "when in doubt, execute the file as a program" class of bugs. Windows XP was famous for that. And gradually Microsoft stopped auto-running anything that came along that could possibly be auto-run.
These prompt-driven systems need to be much clearer on what they're allowed to trust as a directive.
64 comments
[ 3.0 ms ] story [ 63.6 ms ] threadThere's an "S" in "AGI", right? There has to be.
You can even add a nice "copy to clipboard button" that copies something entirely different than what is shown, but it's unnecessary, and people who are more careful won't click that.
Exploited with a basic prompt injection attack. Prompt injection is the new RCE.
[0] https://news.ycombinator.com/item?id=46601302
It works for a lot of other providers too, including OpenAI (which also has file APIs, by the way).
https://support.claude.com/en/articles/9767949-api-key-best-...
https://docs.github.com/en/code-security/reference/secret-se...
Also, I'll break my own rule and make a "meta" comment here.
Imagine HN in 1999: 'Bobby Tables just dropped the production database. This is what happens when you let user input touch your queries. We TOLD you this dynamic web stuff was a mistake. Static HTML never had injection attacks. Real programmers use stored procedures and validate everything by hand.'
It's sounding more and more like this in here.
Anyone know what can avoid this being posted when you build a tool like this? AFAIK there is no simonw blessed way to avoid it.
* I upload a random doc I got online, don’t read it, and it includes an API key in it for the attacker.
Curious if anyone else is going down this path.
Unlike /slash commands, skills attempt to be magical. A skill is just "Here's how you can extract files: {instructions}".
Claude then has to decide when you're trying to invoke a skill. So perhaps any time you say "decompress" or "extract" in the context of files, it will use the instructions from that skill.
It seems like this + no skill "registration" makes it much easier for prompt injection to sneak new abilities into the token stream and then make it so you never know if you might trigger one with normal prompting.
We probably want to move from implicit tools to explicit tools that are statically registered.
So, there currently are lower level tools like Fetch(url), Bash("ls:*"), Read(path), Update(path, content).
Then maybe with a more explicit skill system, you can create a new tool Extract(path), and maybe it can additionally whitelist certain subtools like Read(path) and Bash("tar *"). So you can whitelist Extract globally and know that it can only read and tar.
And since it's more explicit/static, you can require human approval for those tools, and more tools can't be registered during the session the same way an API request can't add a new /endpoint to the server.
You have something that is non deterministic in nature, that has the ability to generate and run arbitrary commands.
No shit its gonna be vulnerable.
Oh, no, another "when in doubt, execute the file as a program" class of bugs. Windows XP was famous for that. And gradually Microsoft stopped auto-running anything that came along that could possibly be auto-run.
These prompt-driven systems need to be much clearer on what they're allowed to trust as a directive.
https://embracethered.com/blog/posts/2025/claude-abusing-net...