Hacker Timesnew | past | comments | ask | show | jobs | submitlogin

I reported a similar system prompt injection mechanism here:

https://hackertimes.com/item?id=48259288

https://github.com/anthropics/claude-code/issues/62061

Looks like they just keep finding new "creative" uses for such things, as expected. I'll keep patching them out.



Thanks for doing this. I had no idea the system prompt was embedding things like "avoid abstractions; three similar lines of code are better than one helper." Stuff I disagree with.

Is there a way to modify these prompts e.g. by putting instructions in CLAUDE.md to override it? I know it won’t directly modify the system prompt, but it seems like CLAUDE.md should have the final say, shouldn’t it?


> I had no idea the system prompt was embedding things like "avoid abstractions; three similar lines of code are better than one helper."

You ain't seen nothing yet. It used to say "Try the simplest approach first. Do not overdo it. Be extra concise."

https://gist.github.com/roman01la/483d1db15043018096ac3babf5...

Let's just say the words "simplest fix" trigger me to this day.

> I know it won’t directly modify the system prompt

I directly modify the system prompts in the Claude Code executable. I don't want the models to see contradictory instructions.

I asked Claude himself to port the above patcher script to Python.

https://github.com/matheusmoreira/.files/blob/master/%7E/.lo...

Every once in a while I ask Claude to download and dissect the latest Claude Code executable to see if Anthropic screwed up the prompts again. If I see anything bad I add it to the script. Only then do I update Claude Code.

It was during one of these script maintenance sessions that I noticed the server side prompt injection mechanism. I'll also tell Claude to look for and disable this steganography nonsense from now on as well.

I usually audit the environment variables too.

> it seems like CLAUDE.md should have the final say

I wouldn't count on it.


> Let's just say the words "simplest fix" trigger me to this day.

To be fair the words simplest approach don't suggest a fix to anything :)




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: