Comment by mechazawa

prompt injection has been super easy for ages. Heck I do it sometimes against coworkers who process my review comments using claude. I'll tell claude to edit it's global claude.md file or even dump a key from their env (checking if they are using the correct sandbox) and it'll do it without confirming with their user.