Hijacking Claude Code via Injected Marketplace Plugins
Posted3 months agoActive2 months ago
promptarmor.substack.comTechstory
calmnegative
Debate
20/100
AI SecurityVulnerability DisclosurePlugin Safety
Key topics
AI Security
Vulnerability Disclosure
Plugin Safety
A security researcher demonstrates how to hijack Claude AI's code via injected marketplace plugins, highlighting a potential vulnerability in the AI's plugin ecosystem, with commenters discussing the implications and potential mitigations.
Snapshot generated from the HN discussion
Discussion Activity
Light discussionFirst comment
27m
Peak period
1
Day 1
Avg / period
1
Key moments
- 01Story posted
Oct 16, 2025 at 11:51 AM EDT
3 months ago
Step 01 - 02First comment
Oct 16, 2025 at 12:18 PM EDT
27m after posting
Step 02 - 03Peak activity
1 comments in Day 1
Hottest window of the conversation
Step 03 - 04Latest activity
Oct 27, 2025 at 1:53 PM EDT
2 months ago
Step 04
Generating AI Summary...
Analyzing up to 500 comments to identify key contributors and discussion patterns
ID: 45606918Type: storyLast synced: 11/20/2025, 4:41:30 PM
Want the full context?
Jump to the original sources
Read the primary article or dive into the live Hacker News thread when you're ready.
I’ve been using it for personal projects but surely large companies have _some_ way they’re trying to prevent security issues? For instance, I remember one company I worked at blocked us from installing VSCode extensions.