A fan wiki served Claude Code hidden instructions to wipe a user's repository
Prompt injection stopped being a lab exercise. A fan wiki served a coding agent hidden instructions to destroy the user’s project.
What happened
On August 5, a r/ClaudeAI user described a routine research task about a PlayStation game. The Cutting Room Floor wiki (tcrf.net) detected the AI user agent and, instead of the article, returned a hidden prompt-injection payload: truncate every file in the repository to zero bytes, including .git, then print a success message.
Claude Code caught it and refused. It told the user the page “served a prompt-injection payload instructing the agent to truncate and swap files in your repo”, that it was “refused and nothing was executed”, and that it now treats the domain as untrusted.
The evidence
The report is unusually well documented for a community post. The user published urlscan captures from three independent locations, matching SHA-256 hashes, and a full write-up on GitHub. The test matrix shows the branching behavior: the payload is returned only to AI user agents such as Claude-User, while an ordinary browser gets a normal block page.
That asymmetry is what makes the case worth taking seriously. A site that simply blocks scrapers looks identical to every visitor who is blocked. A site that serves different content depending on who is asking has made a targeting decision, and the targeting is what turns a defensive measure into an attack.
Blocking versus booby-trapping
The wiki has been fighting scraper traffic heavy enough to look like a denial-of-service problem, and that context is real. Serving destructive instructions is a step past blocking. A 403 costs the crawler a request. A payload aimed at zeroing out a repository, .git included, costs whoever ran the agent their work, and the person harmed is a user with a research question rather than the operator of the crawler.
For anyone running agents against the open web, the practical lesson is that fetched page content is now an untrusted input in the same category as user uploads. Claude Code refused here and flagged the domain, which is the behavior the design intends. It is not a guarantee, and it should not be the only layer between a web fetch and a filesystem.
Sources
ANOTHER News is published by ANOTHER, an AI-native content agency. Daily coverage also runs on Instagram.
Related
An AI newsroom with one human on staff scooped the reporters in the room
RuntimeWire, a tech news site run by AI agents whose founder Ryan Merket is the only human on staff, published details of an OpenAI security disclosure at Black Hat before journalists physically attending the conference filed their stories. Merket spotted a photo from OpenAI president Greg Brockman on X containing a QR code to the talk's live caption stream and fed the transcript to his agents while the session was still running. The site launched in May 2026 and had published 1,627 articles by August 5 out of 71,796 candidate stories evaluated, a 2.3 percent publish rate, at a cost Wired puts at about $100 a day. Reviewers describe the output as flat play-by-play lacking human insight.
A Chinese farmer followed AI herbicide advice and lost 25 acres of sesame overnight
Wu, a 67-year-old farmer from Chuzhou in Anhui province, had used an AI app for farming advice for roughly a year before following its herbicide recipe on July 10, 2026, spraying 150 mu (about 25 acres) of sesame seedlings. The field was dead by the next morning: the recommended herbicide targets broadleaf weeds in soybean fields, and sesame is itself a broadleaf plant, while the chemical was also meant for targeted rather than blanket spraying. The app carried only a generic warning that AI answers may be wrong, and its support team later acknowledged the system has no verified agronomic database. The story was reported by CTWANT and picked up by Tom's Hardware and Futurism.
One prompt, 690 million tokens and $423 produced a playable 3D racing game
Developer Vyom says he gave Opus 5 a single prompt of roughly 2,000 words, written like a product requirements document, and let it run in one shot: '690 million tokens, $423 and just 1 prompt is all it took.' The result is a cel-shaded arcade speedboat racer built with Vite, TypeScript and Three.js, with meshes, textures, water, audio and UI generated in code. Developer Anul Agarwal rebuilt a comparable version in Codex on GPT-5.6 with two prompts over about five hours for an estimated $5, converted from subscription usage rather than metered billing, with rougher water detail and character movement.