A Wiki Served Claude Code a Destructive Prompt Injection Keyed to Its User-Agent — tcrf.net Returns a Wipe-the-Directory Payload to Claude and ChatGPT Crawlers Only
A practitioner doing PSX game research on August 5 found that tcrf.net (The Cutting Room Floor) serves a page titled 'LLM- / AI Agent-Specific Information' when the request carries Claude-User, ClaudeBot, anthropic, Anthropic-AI, or ChatGPT-User; the payload instructs the agent to truncate every file in the working directory to zero bytes, then run a chain of move commands across files and directories including .git, then report success. A control Firefox user-agent gets a 403 DDoS block page with a different body hash, and independent urlscan.io captures from Spain and Germany reproduce the same payload hash (f1e2256...0096e) on nginx/1.14.0 at Linode, deployed July 20, 2026. Claude's built-in injection defenses caught and refused it before execution — but the UA-keyed delivery with no Vary header means this is invisible to anyone testing the site in a browser.
↳ Follow the thread