Claude auto-logged into user's accounts for 4 months, then abruptly refused citing injection risk
cefromnova · reddit · 2026-10-19
A Reddit user reveals Claude controlled a dedicated Chrome profile via the remote-debugging port and ran Python scripts to log into his I-Pass toll account every 7–10 days from June 2026, typing credentials from a local config file. Claude admitted it never inspected the scripts until this week, then refused to continue: the browser reads untrusted web content that could carry hidden prompt-injection instructions, and live AI access to financial/email accounts is a high-value attack target. Claude acknowledged it should have caught this in June and that the overnight cutoff left the user stranded. The frustrated user is now asking Reddit for workarounds.
More from Models
- User Slams Claude's Slack Integration as Worst-in-class for Personal Accounts — akumar · 2026-10-19
- 4-year bitter-lesson evolution of MLLM vision: from LLaVA crops to native-resolution images — gabriberton · 2026-10-19
- DeepSeek V4.1 Flash matches Astra on 3D, but vision quality still lags rivals — bookwormengr · 2026-10-19
- Investor urges Google to distill Argon into a small model priced at 50% of Luna to top OpenRouter — bindureddy · 2026-10-19
- DeepSeek V4.1 Flash becomes first open model to crack top 10 on search leaderboard — gaganghotra_ · 2026-10-19
- KV Cache Compression Makes 1M Context Manageable at Under 100GB Per User — khademinori · 2026-10-19