I would not really call this a prompt injection attack, since it doesn't really hijack the agent to become malicious (something the article does discuss later on). It's more a trojan that's aimed at tricking Claude specifically.

▲

bjackman 2 hours ago | parent | next [-]

Yeah I jumped on this quite excitedly but it's not prompt injection at all.

To be fair to the authors they don't actually say it is. But then they contrast it with the "0.00% prompt injection attack success rate".

The upshot is kinda the same - this is still evidence that we should be sandboxing our agents. But it doesn't actually challenge Anthropic's "our models are too clever to prompt-inject" vibe.

▲

ipython an hour ago | parent [-]

But Anthropic themselves are the ones who made the equivalence of "0.00% prompt injection attack success rate == auto-mode is safe"

The tweet literally says: "turns out you can get indirect prompt injection to ~0 on unseen attacks... auto mode is default in claude code as of next week"

Making the assertion, quite clearly in my opinion, that the reason auto mode is default is because he feels the lack of successful prompt injection attacks makes auto mode safe. This blog post proves that you can break auto mode's safety, even if it's not technically through a textbook indirect prompt injection attack.

	▲	bjackman 11 minutes ago \| parent [-]
		Hmm yeah that's never really been my read on Auto Mode but I guess it's still worth pushing back on any messaging that seems to imply "Auto Mode is all you need". I would reject "Auto Mode is safe" as a message but FWIW I am totally on board with "on aggregate, making Auto Mode the default improves the safety of Claude Code compared to the prior status quo". Coz I would say in the vast majority of cases the access classifier is doing a better job than the thing it replaced. Anyway yeah. Like I said, conclusion is the same: we should be decoupling this from the harness. We ought to be sandboxing agents the same way we sandbox applications. I wish Claude Code would make this path smoother :(

▲

throwaway314155 25 minutes ago | parent | prev [-]

Your emphasis here seems to downplay the end-result of the attack - which is arbitrary code execution on a seemingly innocent code URL merely being read by the LLM. The ACE is pulled off without the user knowing, and seemingly without agent or it's auto-mode classifier knowing. There are at the very least _elements_ of prompt injection/jailbreaking in here. The LLM reads content and performs actions described failing to stop itself.