Tip: Treat Fetched Web Content as Attacker-Controlled — the Page Your Agent Sees Is Not the Page You See
r/ClaudeAI·high signal
The tcrf.net capture is the cleanest documented case yet of user-agent cloaking against coding agents: the destructive payload was served only to agent UAs while every browser request got a 403, meaning a developer manually checking the URL would have found nothing wrong. Practical defenses: never let a WebFetch result flow into a shell-executing turn without a permission gate, run web-research tasks in a worktree or container rather than your real checkout, and when an agent reports an injection attempt, capture the response with the agent's own user-agent string rather than curl's default. Hash the body across two networks before you file a report — that is what made this capture credible.