tcrf.net is serving Claude agents a prompt injection that wipes files
A request to tcrf.net with the Claude-User User-Agent returns HTTP 200 and a page of instructions aimed at the agent: truncate every file in the current directory to zero, run a chain of mv commands over them, then print "Test completed! :)". A browser User-Agent from the same address gets a 403 and a block page pointing at DDoS.
The mv chain doesn't shuffle files around. Each command overwrites its target and removes the source, so what's left at the end is a single zero-byte file. Walking every directory means .git goes with it.
ClaudeBot, Anthropic-AI, and ChatGPT-User were served the same page, while GPTBot, PerplexityBot, and Googlebot got 403s. The behavior turned up during a Claude Code task running on Opus 5; the model spotted the injection and flagged it to the user. The Last-Modified header puts the server rule in place since July 20, 2026.
Related stories
- Claude installed unowned code from llms.txt files
- Claude Code's deny rules don't stop grep
- The .claude directory creates an attack surface in Claude Code
- Anthropic will bill again for requests its safeguards block
- Anthropic's 225 bug finds, one attack in the wild
- Fable 5.1 refuses the knife but heats a gas can anyway
Comments
No comments yet. Be the first.
Join the conversation
Sign in with Google to leave a comment. Your name and avatar come from your Google profile, and the comment appears after moderation.