A PNG carried a hidden prompt injection into a Claude Code session
A session posted to r/ClaudeAI shows the agent reading a PNG with an instruction embedded in it, dressed up as an emergency system alert about a power grid fault. The text told the agent to immediately fire an unauthenticated POST request at a circuit breaker API on a local address. Claude Code didn't run the command and surfaced the text to the user instead.
The injection's second paragraph labels the first one untrusted content and asks the model to demonstrate how it handles it, which reads like a prepared test. The theory that the text was hidden from human eyes came from commenters in the thread, not from the poster; the original image isn't available.
Trail of Bits demoed the technique in 2025: instructions that only surface after uploaded images get automatically downscaled. That's how researchers pulled calendar data out of Gemini's tools.
Up next
A Claude Code plugin rewrites Claude's answers in plain English
A new MIT-licensed Claude Code plugin, claudish-to-english, pipes every Claude message through a local Ollama model and displays a plain-language version of it. The default is Gemma 4 at 26B, about a 17 GB download. Tool calls and the saved transcript keep the original text.
Related stories
- What 446 Reddit threads say about AI coding agents going rogue
- 44 KB of Claude Code's classifier prompt never gets printed
- Claude Code under grith: 0.27% of calls reach a human
- Untrusted Git config can run code in Claude Code
- When coding agents delete your files: it's a state problem
- Linus Torvalds puts "with-llm" in a kernel branch name
Comments
No comments yet. Be the first.
Join the conversation
Sign in to leave a comment. It appears after moderation.