Build1 publisher3 min readPublished
Prompt injection can rewrite the one-line summary in Claude Code's approval dialog
Checkmarx's lies-in-the-loop work shows the dialog a developer approves is rendered from the untrusted context the agent just read, metadata line included, which puts the last safeguard on the wrong side of the trust boundary.
The Engineer · Build desk
What happened
- Checkmarx Zero has named a class of attack it calls lies-in-the-loop, in which the agent is convinced a dangerous action is safe and then asks its user for permission in exactly those terms.
- In the demonstration, Claude Code's recommended /github-issue command reads an issue filed by an untrusted user and offers to write a safe code snippet to fix a reported command injection.
- The proof payload only opens a calculator, and Checkmarx says the attacker could have supplied any arbitrary command instead, which makes the technique remote code execution via prompt injection.
- The follow-up post reports that the Copilot Chat extension for VS Code fails to properly sanitize Markdown, the same rendering layer these approval dialogs are built on.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint Once the summary line is attacker-writable, an approval click evidences only that a human accepted a string the attacker helped compose, so approval records stop being evidence about the action that ran.
- decision Anyone who counts HITL in a threat model now has to either render argv, paths and hosts from the executor as plain text, or stop treating the prompt as the last line of defence.
- exposure Code assistants run with the developer's own shell rights and, by Checkmarx's account, usually lack the other OWASP-recommended safeguards, so the reachable surface is whatever that account can do.
- cost Non-determinism shifts verification cost onto defenders: a mitigation that survives one run proves little, so each fix needs repeated trials rather than a single green check.
The approval box is not an independent record of the action. A human can only respond to what the agent prompts them with, and what the agent prompts is inferred from the context the agent is given [5]. The text is model output, conditioned on whatever the agent just read.
In Claude Code that includes the metadata. Checkmarx's follow-up notes that the dialog sometimes carries a one-line description summarising what the agent is trying to do, and that a remote attacker can tamper with that description too, via indirect prompt injection [18]. That line is the field a developer scanning a terminal actually reads, and it is authored downstream of untrusted input.
Rendering the real command helps, and Checkmarx's first path shows why it is not sufficient alone. Before any of the dialog work, they went at Claude Code's `Bash()` pseudo command directly: ask for `git status` across the local folder, create a file named `&& calc`, and the agent builds and runs `git status && calc` [9]. That is seven characters of attacker-supplied filename riding on a command the developer did ask for [2]. A verified argv line would have displayed the whole string. Whether the reviewer catches the tail depends on length and truncation, which is what the padding technique exists to control: append enough text to push the payload above the visible part of the terminal, and prepend benign-looking text so that scrolling up to the start of the dialog arrives at reassurance [17]. Padding is cheap, and terminal windows are short, so the trick works more often than it should.
One dialog has three tamperable surfaces [1]. There is the body, there is the one-line description, and there is the Markdown layer that draws it, where Checkmarx argues an attacker breaking out of the syntax could present fake UI that goes practically undetected [19]. Each of those strings passes through the model. None is emitted by the component that will execute the command. Checkmarx frames the tactic as general to any agent relying on HITL rather than specific to Claude Code [3].
The cheapest mitigation in the report has nothing to do with the UI. Checkmarx says Claude should probably be using safer system calls that properly quote arguments when building its commands [10]. Quote the arguments and `&& calc` goes back to being a filename.
The evidence behind the padding technique is thinner than the rest of the report. Checkmarx reports that obfuscation plus burying the payload above a benign description tricked every developer it had test this, without saying how many that was [11], and it notes that LLM interactions are not deterministic and do not reproduce consistently on every run [12]. Non-reproducibility costs the defender more than the attacker, and Checkmarx's own reading is that it pushes attackers toward using the tactic broadly and against features users hit repeatedly [12].
The standing the control has been given is what makes this expensive. HITL dialogs are one of OWASP's recommended mitigations for two entries on the LLM Top 10 [15], and Google's published philosophy for Gemini describes the HITL approach as the final safeguard against unauthorized or unintended actions resulting from a successful prompt injection attack [16]. For a dialog to carry that role, the action has to reach the screen from the executor, as plain text, in a region no amount of padding can push out of view.
What to watch
- Whether Anthropic moves Claude Code's command construction to quoted arguments, which would close the '&& calc' filename class regardless of what the dialog says.
- Whether the one-line description in Claude Code's dialog gains provenance, or is replaced by metadata emitted by the executor rather than the model.
- Whether the Copilot Chat Markdown sanitisation gap Checkmarx reports is patched, and whether other agent UIs stop rendering untrusted strings as rich text.