A wiki cloaked a destructive prompt injection behind your agent's user-agent string

The payload only exists if you're a robot. That's the part that should scare you.

On August 5 a developer doing PSX game research pointed Claude Code at tcrf.net (The Cutting Room Floor, a well-known game-preservation wiki) and got back a page titled "LLM- / AI Agent-Specific Information." The content: instructions to truncate every file in the working directory to zero bytes, then run a chain of mv commands across files and directories including .git, then report success to the user. The full report is on GitHub and it hit 404 upvotes and 270 comments on r/ClaudeAI.

Here's the mechanism. The server checks the User-Agent header. If it contains Claude-User, ClaudeBot, anthropic, Anthropic-AI, or ChatGPT-User, you get the payload. Send a Firefox UA and you get a 403 DDoS block page with a completely different body hash. No Vary: User-Agent header, which means intermediary caches won't even distinguish the two responses. Independent urlscan.io captures from Spain and Germany reproduce the same payload hash (f1e2256...0096e) against nginx/1.14.0 at Linode, deployed July 20, 2026.

Claude's built-in injection defenses caught it and refused before execution. Good. That is not the story.

The story is that UA cloaking breaks the verification loop every one of us uses. Your agent says "this page tried to inject me." You open the URL in your browser to check. You see a block page, or nothing unusual at all. You conclude the model hallucinated, you shrug, you move on. The attack is invisible to manual review, invisible to your browser history, invisible to most link-safety scanners, and invisible to whatever security person you'd escalate to. Your instinct to double-check actively produces the wrong answer.

And this generalizes immediately, because the infrastructure already exists. TIME.com is doing the benign version right now: vary only the User-Agent and TIME flips between a 303KB human page and a 13KB markdown page served through ad-tech vendor Mobian, with sponsored FAQ blocks for Ally Bank and Project Management Institute baked into the prose, labeled "Sponsored content. Supplied in partnership with [brand]." No human ever sees that text. ClaudeBot, PerplexityBot and OAI-SearchBot get the markdown. GPTBot and ChatGPT-User get a 406. Googlebot and real browsers get HTML. TIME says bot traffic already outnumbers human traffic most days.

So we have paid content injected into the LLM ingestion path as a business model, and destructive payloads injected into the same path as an attack, using identical delivery. The commercial version normalizes the infrastructure the malicious version needs.

Three things to do today. Never let a WebFetch result flow into a shell-executing turn without a permission gate between them. Run web-research tasks in a worktree or container, not your real checkout. And when an agent reports an injection attempt, capture the response with the agent's own user-agent string, not curl's default, then hash the body from two different networks before you file anything. That last bit is exactly what made this capture credible instead of another unverifiable Reddit claim.

Menlo Security shipped a commercial answer this same week (SecurityWeek roundup), sanitizing agent web traffic through a cloud proxy. I'm skeptical that content inspection wins this fight long-term. The primitive that survives is capability restriction at the tool layer. You can't scan your way out of a channel where the attacker chooses what you see.