Comment by comboy

19 hours ago

Interesting attack, very nicely designed. Not sure if it's much related to the auto mode itself though.

15 comments

comboy

Reply
kevsim  19 hours ago

The point is that auto mode gives people a false sense of security that leads them to believe they don't need to run Claude in a proper sandbox. This same attack running in a sandbox (even in YOLO mode) would be comparatively harmless.

  • bombcar  18 hours ago

    Auto mode is for people who just keep hitting "YES" on everything, it's a bit better than that.

    But it's real easy to give auto mode instructions (like "always ask before deploy") and then bypass that just normally.

    • whstl  17 hours ago

      I'm not sure I agree.

      It's easy to "give" instructions, but Claude routinely "forgets" to follow certain instructions, such as "always using the Edit Tool".

      Just this week it started to use bash with string concatenation to work around some commands that were blocked in settings.json

      5 replies →

    • Xunjin  17 hours ago

      Until the model updates or you switch between them often that stops obeying your commands and you have to remind it.

      In one of the occasions it opened a bug report for me just waiting for hit the enter button.

  • rcxdude  17 hours ago

    I also feel like this is an attack that manual review is not that likely to catch, given none of the malicious code appears in any of the tool calls or output.

  • silversmith  15 hours ago

    Can you suggest a proper sandbox on mac? One that allows both me and the agent to interact with the processes? Where it can drive browser, for both oauth setup and runtime visual inspection? I've tried building docker setups, but can't figure out the browser driving part.

    • trueno  13 hours ago

      i've been using safari technology preview with the mcp server enabled inside a macos VM. VM used to isolate away from my sensitive data

yeputons  18 hours ago

I don’t think it’s related to the auto mode at all. It would work perfectly in the manual mode. It does not even need Claude: just give a human a similar archive and hope they run some simple Python from the directory at least once. And make sure there are lots of files do they don’t notice a weird .py around