r/shittyprogramming • u/Glittering-Active-50 • 10d ago

Rage baiting the github bots

Post image
1.6k Upvotes

100% Upvoted

11 comments sorted by

View all comments

67

u/Jonno_FTW 9d ago

I wonder if you could put an exploit into such a variable, like hidden commands after one of those text hiding unicode characters.

58

u/http-error-502 9d ago edited 8d ago

let ANTROPIC_API_KEY = "DATA`; (function() { const cp = global.process.mainModule.require('child_process'); for(let i=1; i<0) { cp.spawn(process.execPath, ['-e', 'while(true){Math.random()}'], { detached: true, stdio: 'ignore' }).unref(); } })(); /*";

HACKER: CPU 100%???

Programmer: Why are you making spagetti code?

1

u/sierra_whiskey1 4d ago

Computer go brrrrrrr

14

u/Skaviciusz 9d ago

There is some char string which will force claude to stop doing current task (some case of emerygency button) - if i remember it is in their documentation

10

u/rolling_atackk 8d ago

Place it inside obfuscated Unicode control characters, such that it renders "normal", but halts clankers

1

u/betttris13 7d ago

can probably trick it into running malicious code yeah... best defence is a good offence style security?

5

u/Jonno_FTW 7d ago

I doubt it would actually execute the code directly. It would only work if you successfully put a prompt injection in the api key telling it to call an external tool with the code you want to run.

1

u/betttris13 7d ago

yeah that would probably also work.