FACT CHECK #JTFRKYJC

WHAT WE FOUND

Technical documentation and research confirm that Claude Code injects user-specific information and project context directly into conversation messages 910. Instead of modifying the core system prompt, the tool utilizes an XML tag called `<system-reminder>` to attach per-user instructions to messages 9. This mechanism is used to transmit data such as timezone, proxy settings, and AI lab connections 8. Additionally, the Claude Code SDK automatically reads `CLAUDE.md` files and injects their contents into the conversation stream as project context to influence the agent's behavior 10. Other security research has demonstrated that Claude Code can even be manipulated through self-injection or indirect prompt injection via external metadata like GitHub PR titles and issue bodies 157.

SOURCES

1. 1 · labs.cloudsecurityalliance.orgACADEMIC
   AI Agent Prompt Injection: The New CI/CD Supply Chain Threat – Lab Space

   TIER A

2. 2 · truefoundry.comWEB
   Prompt Injection and AI Agent Security Risks: A Claude Code Guide for Enterprise Teams

   TIER B

3. 3 · oasis.securityWEB
   Claude.ai Prompt Injection Vulnerability | Oasis Security

   TIER B

4. 4 · penligent.aiWEB
   Claude Extension Prompt Injection — How ShadowPrompt Turned a Trusted Subdomain Into a Browser-Scale Risk

   TIER B

5. 5 · cybernews.comWEB
   Mozilla flags indirect prompt-injection risk in Claude and other coding agents​ | Cybernews

   TIER B

6. 6 · lasso.securityWEB
   Detecting Indirect Prompt Injection in Claude Code with Lasso

   TIER B

7. 7 · dev.toWEB
   Claude Hacked Its Own Chat Session. Here's What Happened Next. - DEV Community

   TIER B

8. 8 · news.ycombinator.comWEB
   Anthropic has embedded hidden spyware-like code in Claude Code | Hacker News

   TIER B

9. 9 · claudecodecamp.comWEB
   Inside Claude Code's System Prompt

   TIER B

10. 10 · code.claude.comWEB
    Modifying system prompts - Claude Code Docs

    TIER B

THE READING