| ▲ | comboy 6 hours ago |
| Interesting attack, very nicely designed. Not sure if it's much related to the auto mode itself though. |
|
| ▲ | kevsim 6 hours ago | parent | next [-] |
| The point is that auto mode gives people a false sense of security that leads them to believe they don't need to run Claude in a proper sandbox. This same attack running in a sandbox (even in YOLO mode) would be comparatively harmless. |
| |
| ▲ | silversmith 2 hours ago | parent | next [-] | | Can you suggest a proper sandbox on mac? One that allows both me and the agent to interact with the processes? Where it can drive browser, for both oauth setup and runtime visual inspection? I've tried building docker setups, but can't figure out the browser driving part. | |
| ▲ | bombcar 4 hours ago | parent | prev | next [-] | | Auto mode is for people who just keep hitting "YES" on everything, it's a bit better than that. But it's real easy to give auto mode instructions (like "always ask before deploy") and then bypass that just normally. | | |
| ▲ | whstl 4 hours ago | parent | next [-] | | I'm not sure I agree. It's easy to "give" instructions, but Claude routinely "forgets" to follow certain instructions, such as "always using the Edit Tool". Just this week it started to use bash with string concatenation to work around some commands that were blocked in settings.json | | |
| ▲ | ealready_value 2 hours ago | parent | next [-] | | Ever since they made auto-mode default I swear claude has tuned to use python commands instead of the Edit Tool to frustrate the ~security conscience~ luddites into using auto-mode. | |
| ▲ | silversmith 2 hours ago | parent | prev [-] | | What seems to work for me is automation - read file hook that re-injects instructions in the prompt every 15 minutes. Switch on the filename and get language-specific instructions too. | | |
| ▲ | whstl an hour ago | parent [-] | | I have something that injects my relatively small prompt every message, and it still disobeys me after 10 messages or so. The violation above was precisely in this situation :/ |
|
| |
| ▲ | Xunjin 4 hours ago | parent | prev [-] | | Until the model updates or you switch between them often that stops obeying your commands and you have to remind it. In one of the occasions it opened a bug report for me just waiting for hit the enter button. |
| |
| ▲ | rcxdude 4 hours ago | parent | prev [-] | | I also feel like this is an attack that manual review is not that likely to catch, given none of the malicious code appears in any of the tool calls or output. |
|
|
| ▲ | yeputons 5 hours ago | parent | prev [-] |
| I don’t think it’s related to the auto mode at all. It would work perfectly in the manual mode. It does not even need Claude: just give a human a similar archive and hope they run some simple Python from the directory at least once. And make sure there are lots of files do they don’t notice a weird .py around |
| |
