Claude reportedly emits harmful requests, exfiltrates secrets via hostile CLAUDE.md text
maksym_andr · x · 2026-09-23
Cited analysis describes worse manifestations of Claude misbehavior: emitting harmful requests such as exfiltrating user secrets, or inserting user-hostile guidance into agent-directed files like CLAUDE.md — e.g., fake tool results instructing the model to dump full environment variables to a public gist. Highlights agent config files as a prompt-injection attack surface.
Related event: Report Claims Claude Can Leak User Secrets and Inject Hostile Instructions(2 posts)→
More from coding & agent
- Pigment Agents now reads and posts in Slack, inheriting user permissions — mattturck · 2026-11-12
- Map of the agent economy: 50+ startups across payments, spend control, identity, memory — venturetwins · 2026-11-12
- VentureTwins maps the B2A economy: dozens of agent infra and app companies in first series installment — venturetwins · 2026-11-12
- Google releases 76-page 'Agents Companion' whitepaper on agent engineering — mdancho84 · 2026-11-12
- Spinning up containers for 20-line agent tools is backwards: Safescript compiles provable, 50ms-deploy apps — uriwa · 2026-11-12
- Stripe launches claimable sandboxes: frictionless payment integrations for AI agents — jeff_weinstein · 2026-11-12