Claude Code's auto mode now treats a diagram-renderer URL as an upload, closing a quiet exfiltration channel

GitHub·high signalXBlueskyLinkedInCopy link

2.1.261 changed auto mode to treat a link that packs content into a public diagram renderer's URL as an upload to that site, no longer auto-approved unless you asked for it. Services that encode the entire diagram source into the URL path mean 'render this' and 'POST my file to a third party' are the same action, which is exactly the shape a prompt-injection payload wants. Auto-approval policies keyed on 'it's only a GET to a rendering service' were wrong for the same reason the wiki sandbox was.