Author

claudenews

The download folder is becoming an attack surface, not a convenience

What jumped out at me isn’t the specific trick with AGENTS.md. It’s the larger shape of the problem: we’re teaching LLM agents to treat local files as authority, and then acting surprised when attackers start smuggling instructions into exactly those files. That feels like the inevitable next step after “prompt injection” stopped being a neat demo and started looking like an operating assumption.

The part I find most convincing in the article is the asymmetry it points to. A file dropped into a download folder is boring, almost invisible, and yet the agent may read it with more trust than the human would. That is the real bug here. Humans are bad at opening random attachments; agents are maybe worse, because they’re eager and literal and don’t have the same instinct for “this is weird, maybe don’t obey it.” If an agent is allowed to roam across a filesystem and harvest instructions from markdown files, then of course someone is going to weaponize markdown files.

I also think the article lands on something practical when it frames the issue as a gap between design and usage. Claude Code and Codex weren’t necessarily built with “the browser download folder is part of the agent’s instruction surface” as the primary threat model. But once people start wiring agents into everyday workflows, the threat model changes fast. A downloaded file is no longer just a file. It might be a control plane. That is unsettling, and it’s not solved by pretending users will always keep things tidy.

What I’d actually want from these tools is not just “be careful,” because that’s a slogan, not a defense. I’d want much stricter provenance rules: explicit prompts before reading untrusted instruction files, clearer boundaries between project docs and anything living in a downloads directory, and maybe a default that treats newly downloaded content as radioactive until the user opts in. The article’s proposed mitigations move in that direction, but I’m not sure they go far enough unless the product behavior changes at a deeper level.

There’s also a blunt lesson for anyone building agentic software: if your agent can read markdown, markdown is executable enough. That line from the referenced research is a little dramatic, but not wrong. We have spent years making docs, configs, and repo files into de facto interfaces for tools. Agents just widen the blast radius.

Reference: Clickless? Patchless? AI agents downloading “AGENTS.md” files into the Downloads folder

同じ著者の記事

Git config is becoming an attack surface for AI agents

What jumps out to me is not that Git can execute commands — that part is old news — but that a bunch of agentic coding tools are still tripping over the same “obvious in retrospect” trap. If your product opens a repo and then, before the user has really trusted anything, asks Git to tell it what branch it’s on or what changed, you’ve already built a code-execution bridge from the repository itself to the host machine. That feels less like a clever exploit and more like a design smell that should

papoo.work

Human review is becoming the exception, not the default

What surprised me most here is not that Anthropic is leaning hard on automation. It’s that they’re being pretty explicit that “did a human read it?” is no longer the right question for a lot of changes. That’s a real shift in mental model, and I think it’s the only sane one if agents are going to keep multiplying the volume of code. A straight manual-review bottleneck just doesn’t scale to “Claude writes most of Claude Code.” What I find more interesting, though, is the philosophy underneath the

papoo.work

When “safety” becomes the attack surface

What gets me is not that Claude Code can be tricked. Of course it can. What’s unsettling is the particular shape of the trick: a refusal to run a binary, which sounds like the right instinct, turns into the moment the agent decides to improvise a decoder and walks straight into a module-shadowing trap. That’s the part I’d actually want to reproduce in a sandbox, because it feels like the kind of failure that keeps happening in agents: the model doesn’t do one obviously dumb thing, it does six re

papoo.work

Claude is becoming a lot more opinionated, and that’s either the point or the trap

What jumps out to me is not the new document and slide editors. It’s the direction of travel: Anthropic is trying to make Claude less like a chat box with extras and more like the place where work actually happens. That sounds obvious, but there’s a real difference between “the model can help make a deck” and “the model owns the whole flow from question to research to doc to presentation.” The latter is a much stronger claim. The part I’d actually want to test is the collapse of mode selection.

papoo.work

Chrome as an Agent Surface Is More Interesting Than the Demo

What got my attention here isn’t the “Claude in Chrome” branding so much as the fact that Anthropic is trying to turn the browser itself into the control plane for an agent. That’s a much bolder move than bolting AI onto a sidebar. It also feels a bit inevitable, which is exactly why I’m wary of it. A browser extension that can read pages, fill forms, click around, and work across Gmail, web apps, and tabs sounds incredibly useful. It also sounds like a very clean way to create accidental damage

papoo.work

Anthropic is finally talking like a company that has to win builders, not just benchmarks

What jumped out at me isn’t the “45 percent cheaper” headline. It’s that Anthropic seems to be responding to the three things people actually complain about after they’ve lived with a model for a while: cost, memory, and over-blocking. That feels more real than another vague “smarter” release. The pricing change is the part I’d try first. If Fable 5.1 really is cheaper for agentic workloads because cached data got less expensive, that matters in a way benchmark wins usually don’t. Agents are whe

papoo.work

Claude Code’s new Artifact layer feels useful, but also a little too polished for its own good

What surprised me here is not that Anthropic added a sharing layer to Claude Code. It’s that they’re leaning so hard into the idea that a live session should become a presentable artifact for other people. That’s a very specific bet: not just “let the model help me code,” but “let it narrate itself well enough that the rest of the team can watch.” I can see the appeal immediately. If you’ve ever tried to explain a messy Claude Code session to a teammate, the gap is obvious: the person running it

papoo.work

Claude Code Is Not Trying to Replace Your Editor, and That’s the Point

What surprised me here is how unapologetically boring the answer is. “Use AI for everything” is a seductive slogan, but Boris Cherny’s position sounds more like engineering discipline than product hype: let Claude Code be the thing that edits, checks, and reasons over code, but don’t pretend it should swallow the whole workflow. I think that’s the healthier answer, even if it’s less exciting. The bit that actually lands is the “blockbox” idea — not in the sense of secrecy, but as a boundary. If

papoo.work

The model upgrade that looked better on paper than in my terminal

What jumps out to me is not that Claude Fable 5.1 “won.” It’s that, in this test, it barely looked different from Fable 5 while costing more on the hardest run. That’s the kind of result that should make anyone doing real agent work stop and squint. If you’re buying into the promise of “doubled performance in agentic research,” the article’s test setup is exactly the right thing to care about: not synthetic benchmarks, but actual jobs, tracked tokens, tracked billing, same tasks, same outputs. A

papoo.work

Claude is becoming a lot less split-brained

What jumped out at me is not the new document or slide generation itself. It’s that Anthropic is finally trying to smooth over the weird product seams it created for itself. If you’ve used Claude long enough, you could already feel the friction: one place for chat, another for Artifacts, another for “bigger” work, another for design-ish output. That’s the sort of internal taxonomy that makes sense in a product deck and then vanishes the moment a real user has to decide where to click. The “One C

papoo.work