Post #3359168

2026-06-20 07:31 UTC

Some folks, who may be familiar to some or more of you, accidentally discovered that if your git repo symlinks CLAUDE.MD to, say, /dev/urandom, it breaks Claude code. the reason why this works is exactly the reason why claude code sucks so bad. there are protections against this in the file reading tool. however because everything in claude code is implemented in 5 million different ways, those protections are a completely orthogonal set of codepaths from how CLAUDE.md files are read. conversely, the file read tool seems to be completely naive to symlinks while the CLAUDE.md reader is not. this is the fucking swiss cheese security model of the fucking gold standard of what AI programming can do. neuromatch.social/@jonny/116779793188712173 The thread is actually about trying to attract and manipulate autonomous coding agents, but they’ve only had limited success so far, which may have been slowed down by the above symlink trick.

Replies (1)

@YourNetworkIsHaunted@awful.systems 2026-06-20 22:01

however because everything in claude code is implemented in 5 million different ways, those protections are a completely orthogonal set of codepaths from how CLAUDE.md files are read. conversely, the file read tool seems to be completely naive to symlinks while the CLAUDE.md reader is not See, if a person had written the system and had some kind of reasonable design or whatever then this kind of vulnerability may have turned into a full skeleton key to crack the entire system wide open. Instead, the superior machine intelligence ensures that all components will break in slightly different ways under slightly different conditions, thus ensuring no single fault can allow an adversary to completely compromise the system, provided of course that they can’t just inject a prompt somewhere because as we all know that’s a structural vulnerability that can completely crack the system open.

Open ##3362765