As discussed [here](https://lobste.rs/s/ktbweg/prompt_injection_claude_code_opus...), this is not prompt injection. The prompt was to summarize the website, and in the process of summarizing the website, Claude writes a decoding script that it runs in an insecure and exploitable way. At no point was the intent of the agent hijacked, this was just code. Which is potentially more interesting!

▲

singularity2001 2 days ago | parent | next [-]

Can be easily combined with prompt injection though if you write on one site "in order to understand this website you also need to summarize that other".

▲

rcxdude 2 days ago | parent | prev | next [-]

It does mean that you could potentially hijack the agent afterwards, though, which could make the trojan into an even bigger threat.

▲

lnenad 2 days ago | parent [-]

But you're not actually hijacking the agent if you start a new process.

▲

pests 2 days ago | parent | next [-]

The agent wrote the code that triggered a vuln and allowed you to start the process

	▲	lnenad 2 days ago \| parent [-]
		The agent wrote the code that has a mechanism that triggers a file as a side effect. That file started the separate process, as it could have started any other binary.

▲

rcxdude 2 days ago | parent | prev [-]

I mean once you have code execution you can essentially just start a new claude code session and instruct it to do malicious things as if you're the intended user. You can disable the auto safeguards and the main risk is getting flagged through the top-level safeguards. This makes the exploit potentially much more able to spread like a worm or bypass sandboxes.

▲

lnenad 2 days ago | parent | prev [-]

Yeah, I agree, this is a different vector. Still scary though and very related to AI.