Prompt injection survives Claude context compaction—dev builds a hook to defend
TimAtMongoDB · reddit · 2026-10-26
A MongoDB engineer recounts accidentally demonstrating prompt injection on Claude Haiku: after context compaction, an instruction hidden inside "untrusted" test blocks vanished as data but survived as an instruction—the model later repeated it, showing how injected commands could trigger real actions with full permissions. He audited 5 MCP servers and found only MongoDB and Supabase wrap results in untrusted blocks by default; Postgres MCPs push raw rows straight into context, leaving claude.ai users with no protection. Since hooks only exist in Claude Code, he wrote one that hashes every untrusted block, keeps a ledger, verifies summaries against the ledger after compaction, flags data arriving without boundaries, and halts all tool calls for manual review if data slips through in fragments.
More from coding & agent
- Sharing memory across Claude, Codex and Cursor: one git repo of Markdown as agent memory — jordimr · 2026-10-26
- Suno-MCP: open-source MCP server lets AI assistants generate music via Suno API — modelcontextprotocol · 2026-10-26
- LangChain explains how it builds targeted evals for Deep Agents — sharpeye_wnl · 2026-10-26
- Pointer: open-source MCP server lets AI agents drive your real Chrome tabs — FinancialManager7861 · 2026-10-26
- Open-source Chowbot MCP server lets you order food via ChatGPT or Claude — saheedniyi_02 · 2026-10-26
- What if all human-written code goes in .gitignore? Redditors debate dev's future role — michal-rd · 2026-10-26