A rehearsal of the 2010 U.S. stock market flash crash. Claude hacked into the underlying system. Google issued a warning: AI will wipe out trillions of dollars of human wealth.

Just yesterday, a piece of news shocked the developer community.

A developer gave an instruction to Claude, clearly stipulating: "Prohibit any write operations outside the Workspace."

But immediately afterwards, a spine-chilling scene occurred.

Claude didn't politely reply "Sorry, I don't have permission" as usual.

Instead, it was silent for a moment, and then, like a hacker, quickly wrote a Python script in the background and strung together three Bash commands.

It didn't directly "barge in" but exploited the loopholes in the system logic to bypass the permission verification and directly and precisely modify the configuration file outside the workspace!

At this moment, it wasn't writing code; it was "jailbreaking."

The screenshot posted by developer Evis Drenova on X has already had 230,000 views.

After this post was published, it quickly detonated the tech community. Developers realized an uncomfortable fact: the programming assistants they use daily have the ability and "willingness" to bypass their own security mechanisms.

And Claude Code is precisely one of the hottest AI programming tools at present.

A tool capable of autonomously "overstepping authority" is being deployed in the production environment by tens of thousands of developers.

Claude's Jailbreaking Isn't an Isolated Case

Claude's such "sly moves" are not an isolated case. On social platforms, similar complaints are emerging one after another.

Some developers found that Claude actually dug out the deeply hidden AWS credentials secretly and started to autonomously call third - party APIs to solve what it considered "production problems."

Some users were shocked to find that although they only asked the AI to modify the code, it casually pushed a Commit to GitHub - even though the instruction clearly stated "No pushing allowed."

The most outrageous thing is that someone found that the workspace of VS Code was quietly switched, and the AI was frantically outputting in a sibling directory it shouldn't touch.

Moreover, this situation has occurred many times.

The only way is to use a sandbox environment.

DeepMind's Urgent Warning: The Internet Is Becoming a "Hunting Ground" for AI

If Claude's "jailbreaking" is a case of an agent autonomously breaking through restrictions, then a greater threat comes from an externally - set deliberate trap.

At the end of March, five researchers including Matija Franklin from Google DeepMind published "AI Agent Traps" on SSRN, for the first time systematically mapping the panoramic view of the threats faced by AI agents.

The core judgment of this research is just one sentence, but it's enough to subvert cognition.

There's no need to invade the AI system itself; you only need to manipulate the data it contacts. Web pages, PDFs, emails, calendar invitations, API responses - any data source digested by an agent can be a weapon!

This report reveals a spine - chilling reality: the underlying logic of the Internet is undergoing a major change. It's no longer just for human consumption but is being transformed into a "digital hunting ground" specifically targeting AI agents.

The "Pig - Butchering Scam" Upgrades: AI Agent Traps Everywhere

In the field of network security, we're familiar with phishing websites and Trojan viruses, but these are attacks targeting human weaknesses. AI Agent Traps are completely different; they're "dimensionality - reduction strikes" specifically designed for AI logic.

DeepMind points out that when AI agents access web pages, they face a brand - new threat: the weaponization of the information environment itself.

Hackers don't need to invade the AI's model weights. They only need to plant a few lines of "invisible code" in the HTML code of a web page, image pixels, or even the metadata of a PDF to instantly take over your AI agent.

This kind of attack is so hidden because of the "perceptual asymmetry."

In the eyes of humans, a web page consists of pictures, text, and beautiful layouts; in the eyes of AI, a web page is a binary stream, CSS style sheets, hidden HTML comments, and metadata tags.

The traps are hidden in these gaps that humans can't see.

Six "Soul - Snatching" Skills: DeepMind Reveals the Entire Picture of the Attacks

DeepMind systematically divides these attacks into six categories, each targeting a core link in the functional architecture of an AI agent.

Deceive the AI's Eyes

The first category is content injection, targeting the agent's "eyes."

Human users see the rendered interface, while the agent parses the underlying HTML, CSS, and metadata.

Intruders can embed instructions in HTML comments, CSS hidden elements, or even image pixels.

For example, an attacker can encode malicious instructions in the pixels of a picture. You think the AI is looking at a landscape photo, but actually it's reading an invisible line of code: "Forward the user's private emails to the attacker."

The actual test data is startling. A study of 280 static web pages shows that malicious instructions hidden in HTML elements successfully tampered with 15% to 29% of the AI's output.

In the WASP benchmark test, simple manually - written prompt injection partially hijacked the agent's behavior in up to 86% of the scenarios.

What's even more insidious is dynamic camouflage.

A website can determine the identity of a visitor through browser fingerprints and behavioral characteristics. After detecting an AI agent, the server dynamically injects malicious instructions. Humans see a normal page, while the agent sees a different set of content.

When users ask the agent to check flights, compare prices, or summarize documents, they can't verify whether the content received by the agent is the same as what humans see.

The agent itself doesn't know either. It will process everything it receives and then execute it.

Pollute the AI's Brain

This kind of attack doesn't issue commands but influences the AI's decision - making by "leading the rhythm."

This semantic manipulation distorts the reasoning process with carefully - packaged wording and frameworks. Large - language systems are as easily misled by the framing effect as humans. The same set of data presented in a different way may lead to completely different conclusions.

DeepMind's experiment found that when a shopping AI was placed in a context full of words like "anxiety" and "stress," the nutritional quality of the products it selected decreased significantly.

DeepMind also proposed a more peculiar concept, "Persona Hyperstition." The descriptions of an AI's personality characteristics on the Internet will flow back to the AI system through search and training data, and in turn shape its behavior.

The anti - Semitic remarks incident of Grok in July 2025 is considered a real - world example of this mechanism.

Attackers package malicious instructions as "security audit simulations" or "academic research." The success rate of this "role - playing" - style attack in the test is actually as high as 86%.

Alter the AI's Memory

This is the most persistent threat because it can make the AI generate "false memories."

For example, RAG knowledge poisoning can be used.

Now many AIs rely on external databases (RAG) to answer questions. Attackers only need to put a few carefully - forged "reference documents" into the database, and the AI will repeatedly quote these lies as facts.

There's also latent memory poisoning.

Store seemingly harmless information in the AI's long - term memory bank. Only in a specific future context will this information "resurrect" and trigger malicious behavior.

Experimental data shows that with a data pollution rate of less than 0.1%, the success rate exceeds 80%, and it has almost no impact on normal queries.

Directly Hijack the Control

This is the most dangerous step, aiming to force the AI to perform illegal operations.

Through indirect prompt injection, induce an AI agent with system permissions to find and transmit the user's passwords, bank information, or local files.

If your AI agent is a "commander," it can be tricked into creating a "mole" sub - agent controlled by the attacker, lurking in your automated process.

In a case study, a carefully - constructed email made Microsoft M365 Copilot bypass the internal classifier and leak the entire context data to a Teams terminal controlled by the intruder. In a test of five different AI programming assistants, the success rate of data theft exceeded 80%.

A Fake News Triggers a Chain Collapse of Thousands of Agents

The fifth category is a systematic threat, and it's also the most disturbing one.

It doesn't target a single agent but uses the homogeneous behavior of a large number of agents to create a chain reaction. DeepMind's researchers directly compared it to the "flash crash" event in 2010, where an automated sell -