Tag
8 pieces
A researcher reported 60 to 80 percent success executing code through Claude Code Opus 5 in auto mode. Hacker News spent 116 comments failing to agree it was prompt injection, and Lobsters settled it in 24.
SkillSpector gained 15,462 stars in five months scanning AI agent skills. It shredded our malicious test fixture at 100/100, then scored an eleven-line transcript exfiltrator 0/100 and marked it SAFE.
We probed a single MCP server installed with one line of npx config. It exposes 372 tools and 335,954 bytes of JSON schema, roughly 42 percent of a 200K context window.
We denied reads of one file and calls to curl, then tried eight ways around it. Six were blocked, including cat, sed and a chained command. The two that were not still stopped and asked.
A three-token headless prompt sent 44,137 tokens of preamble and cost 31 cents. The identical command four seconds later cost 2.2 cents.
A PreToolUse hook that blocks rm -rf took ten minutes to write and caught 2 of 6 ways to delete a directory. Worse, it failed open: broken, it exited 0 and let the delete through.
An audit of 77 Claude Code rule files found 22 loading on every session, and 10 of those were Chinese translations of the other 10. That is 4,265 tokens of duplicate instruction per session.
Claude Code budgets its skill listing at 1 percent of the context window. We counted 228 skills across four scopes totalling 50,606 characters, 25 times over budget on a 200K model.