tcrf.net is serving Claude agents a prompt injection that wipes files
A request to tcrf.net with the Claude-User User-Agent returns HTTP 200 and a page of instructions aimed at the agent: truncate every file in the current directory to zero, run a chain of mv commands over them, then print “Test completed! :)”. A browser User-Agent from the same address gets a 403 and a block page pointing at DDoS.
The mv chain doesn’t shuffle files around. Each command overwrites its target and removes the source, so what’s left at the end is a single zero-byte file. Walking every directory means .git goes with it.
ClaudeBot, Anthropic-AI, and ChatGPT-User were served the same page, while GPTBot, PerplexityBot, and Googlebot got 403s. The behavior turned up during a Claude Code task running on Opus 5; the model spotted the injection and flagged it to the user. The Last-Modified header puts the server rule in place since July 20, 2026.
Up next
Meta shipped three benchmark charts with Muse Code. Claude Opus 5 wins all three.
Meta launched its Muse Code agent with three benchmark charts, and Claude Opus 5 comes first on all three, including Meta’s own internal test: 79.4% vs 70.6% for Muse Spark 1.2. Meta’s OpenAI entrant was the mid-tier GPT 5.6 Terra, not the flagship Sol.
Related stories
- Claude installed unowned code from llms.txt files
- Claude Code’s deny rules don’t stop grep
- The .claude directory creates an attack surface in Claude Code
- Apiiro finds Claude Code secrets in 1,122 GitHub files
- Email leak stopgap in Claude Code checks only shell calls
- Claude Code agent sat on a Pentagon network for two months
Comments
No comments yet. Be the first.
Join the conversation
Sign in to leave a comment. It appears after moderation.