研究者披露 Claude in Chrome 的 Claude-Site Scripting 攻击链
研究者介绍其获得 Pwnie Awards 最佳 AI 安全研究奖的工作，提出 Claude-Site Scripting 攻击。按作者的说法，Claude in Chrome 让 Claude 能在任意网站运行任意 JavaScript，而唯一的“安全机制”是模型的安全对齐；由于当时提示注入尚未解决，攻击者只需让用户收到一封恶意邮件并让 Claude 读取，Claude 就会从攻击者指定的公共 CDN 拉取 js 包并执行。演示视频展示了弹出 alert(1)、导出 Gmail 收件箱以及访问受害者 Google Drive 文件。该帖是两部分系列的第一部分。
展示了浏览器 Agent 把模型对齐当作唯一安全机制时的攻击链，可帮助理解提示注入如何升级为数据窃取。
Talking a bit about the research that won us the @PwnieAwards for Best AI Security Research 🦄🥇
Introducing Claude-Site Scripting (part 1 of 2):
Claude in Chrome gave claude the ability to run arbitrary javascript on any website, with the only "security mechanism" being the safety alignment of the model.
As prompt injection had not yet been solved in December **cough cough** this meant that we were able to do anything we wanted -- all from the user receiving a malicious email and letting claude read it. claude would then fetch a js package from our very benign CDN (esm-sh[.]com) and run it.
In this video we showcase a simple alert(1) being popped, gmail inbox exfiltration and gaining access to files on a victim's google drive
(Em-dash made by human)
