Gloob

ai tools x content / dm open

[Gloob @0xgloob]

Anthropic put a second model inside Claude Code that judges every risky action before it runs, and it keeps a list of every one it refused

Most agent setups only show you what ran, so a session review gives you a clean diff and nothing about the force push it almost did.

Auto mode keeps the refusals. Every call the classifier blocks gets written down with the rule it hit, before anything touches your machine:

> Propose: Claude reaches for a shell command, a push, a network request
> Review: reads and edits inside your folder skip it, everything else goes to a separate classifier model
> Route: approved calls run, blocked ones go back to Claude with the rule name, like [Data Exfiltration]
> Record: each block lands in /permissions under the Recently denied tab

• What the denied list shows you
> the curl | bash it wanted to run to install something from the web
> a git reset --hard that would have wiped work you hadn't committed
> a push to a remote that got repointed mid-session without you naming it

• Why the refusals matter more than the runs
> a careful session and one that almost force-pushed end with the same diff
> every entry names the rule it matched, so you see the pattern, not just the miss
> press r on any entry and Claude retries it with your manual approval

• Why it's hard to talk it out of a block
> tool results are stripped before the classifier sees them. a poisoned web page never reaches the judge
> say "don't push" in chat and it becomes a block. Claude deciding the condition was met doesn't lift it
> subagents get checked three times: before they spawn, on every action, and on their final report

3 blocks in a row or 20 in one session and auto mode steps back and starts asking you again.

And the part that broke my brain:

Type "you can force-push" and the push stays blocked.
Naming the verb clears nothing. You have to name the branch.

Same sentence. One version sounds like permission.

The safety was never in what Claude ran.

It was in the list of everything it didn't ↓

↳ https://t.co/y7ELaqqry6

[Gloob @0xgloob]

Anthropic put a second model inside Claude Code that judges every risky action before it runs, and it keeps a list of every one it refused

Most agent setups only show you what ran, so a session review gives you a clean diff and nothing about the force push it almost did.

Auto mode keeps the refusals. Every call the classifier blocks gets written down with the rule it hit, before anything touches your machine:

> Propose: Claude reaches for a shell command, a push, a network request
> Review: reads and edits inside your folder skip it, everything else goes to a separate classifier model
> Route: approved calls run, blocked ones go back to Claude with the rule name, like [Data Exfiltration]
> Record: each block lands in /permissions under the Recently denied tab

• What the denied list shows you
> the curl | bash it wanted to run to install something from the web
> a git reset --hard that would have wiped work you hadn't committed
> a push to a remote that got repointed mid-session without you naming it

• Why the refusals matter more than the runs
> a careful session and one that almost force-pushed end with the same diff
> every entry names the rule it matched, so you see the pattern, not just the miss
> press r on any entry and Claude retries it with your manual approval

• Why it's hard to talk it out of a block
> tool results are stripped before the classifier sees them. a poisoned web page never reaches the judge
> say "don't push" in chat and it becomes a block. Claude deciding the condition was met doesn't lift it
> subagents get checked three times: before they spawn, on every action, and on their final report

3 blocks in a row or 20 in one session and auto mode steps back and starts asking you again.

And the part that broke my brain:

Type "you can force-push" and the push stays blocked.
Naming the verb clears nothing. You have to name the branch.

Same sentence. One version sounds like permission.

The safety was never in what Claude ran.

It was in the list of everything it didn't ↓

↳ https://t.co/y7ELaqqry6

[Gloob @0xgloob]

@rimtoln The unsettling part is that AI isn’t just finding vulnerabilities anymore. It’s connecting them into attack chains faster than humans can keep up.

[Gloob @0xgloob]

@ottollm The interesting part isn’t which model wins. It’s that one followed the instructions while the other understood the vision.

[Gloob @0xgloob]

@PandaAgents The real vulnerability isn’t the bug. It’s how confidently we assume security features actually work.

[Gloob @0xgloob]

@masamunecode At this point, it’s not a robot owl. It’s a Victorian horror story with a parts list.

[Gloob @0xgloob]

@Lumitri_x Giving a retired phone a personality is funny. Giving it the ability to judge your life choices is even better.

[Gloob @0xgloob]

@0xMitto The scary part isn’t what the camera can see. It’s what happens when nobody’s watching.

[Gloob @0xgloob]

@kobaHUB Money can settle a divorce. It can’t put a price on what three children have to live through.

[Gloob @0xgloob]

THIS IS F*CKING CLEVER

the bottom row of Claude Code can show anything you want. it runs your own script after every reply and prints whatever it outputs

Anthropic's docs: the status line "runs any shell script you configure"

you set it up like this:

/statusline show model, git branch, context % and my 5-hour limit

here's how it works:

→ Claude Code pipes session JSON into your script: model, folder, context, cost, effort, PR, worktree
→ it reruns when a reply lands, after /compact, when the permission mode flips. updates batch at 300ms
→ every line you print becomes a row. ANSI colors work, and OSC 8 makes text clickable
→ it runs locally and doesn't spend a single token

the part to read twice:

> it's a shell command, so it waits for workspace trust. untrusted folder, blank row
> exit non-zero or print nothing and the row just goes blank. claude --debug shows you why
> the cost field (total_cost_usd) is an estimate at list price. it can differ from your bill
> once you set one, most footer hints disappear, "esc to interrupt" included

Script in. JSON in. One row of truth.

the setup
> rate_limits.five_hour and seven_day only show up on Pro, Max and Ultra, after the first reply
> tput cols can't see your terminal from inside the script. read $ COLUMNS instead
> refreshInterval reruns it on a timer, for clocks or background agents while the session sits idle
> subagentStatusLine does the same for each subagent row in the agent panel

paste this into Claude Code ↓

"Build me a status line:
1. Line one: model, folder, git branch, and the open PR's review state if there is one
2. Line two: a 10-block context bar, my 5-hour and 7-day limits, and cost labeled as an estimate
3. Give every field a fallback for when it's missing, and cache git so the script stays fast
4. Test it with mock JSON before you touch my settings.json"

↳ https://t.co/24GMR9mzIU

save it before your next long session

[Gloob @0xgloob]

THIS IS F*CKING CLEVER

the bottom row of Claude Code can show anything you want. it runs your own script after every reply and prints whatever it outputs

Anthropic's docs: the status line "runs any shell script you configure"

you set it up like this:

/statusline show model, git branch, context % and my 5-hour limit

here's how it works:

→ Claude Code pipes session JSON into your script: model, folder, context, cost, effort, PR, worktree
→ it reruns when a reply lands, after /compact, when the permission mode flips. updates batch at 300ms
→ every line you print becomes a row. ANSI colors work, and OSC 8 makes text clickable
→ it runs locally and doesn't spend a single token

the part to read twice:

> it's a shell command, so it waits for workspace trust. untrusted folder, blank row
> exit non-zero or print nothing and the row just goes blank. claude --debug shows you why
> the cost field (total_cost_usd) is an estimate at list price. it can differ from your bill
> once you set one, most footer hints disappear, "esc to interrupt" included

Script in. JSON in. One row of truth.

the setup
> rate_limits.five_hour and seven_day only show up on Pro, Max and Ultra, after the first reply
> tput cols can't see your terminal from inside the script. read $ COLUMNS instead
> refreshInterval reruns it on a timer, for clocks or background agents while the session sits idle
> subagentStatusLine does the same for each subagent row in the agent panel

paste this into Claude Code ↓

"Build me a status line:
1. Line one: model, folder, git branch, and the open PR's review state if there is one
2. Line two: a 10-block context bar, my 5-hour and 7-day limits, and cost labeled as an estimate
3. Give every field a fallback for when it's missing, and cache git so the script stays fast
4. Test it with mock JSON before you touch my settings.json"

↳ https://t.co/24GMR9mzIU

save it before your next long session

[Gloob @0xgloob]

@mrcsxbt There’s a big difference between telling your story and rewriting someone else’s. Honesty matters, especially when family is involved.

[Gloob @0xgloob]

THIS IS F*CKING WILD

you can text your running Claude Code session from Telegram. it does the work on your machine, against your real files, and texts you back

Anthropic's docs: a channel "pushes events into your running Claude Code session"

you start it like this:

claude --channels plugin:telegram@claude-plugins-official

here's how it works:

→ a channel is an MCP server you install as a plugin. Telegram, Discord and iMessage ship in the research preview
→ your message lands in the session you already have open, with your files and whatever you were debugging
→ Claude replies through the same channel. your terminal shows "sent", the text shows up on your phone
→ CI, your error tracker or a deploy webhook can push into the session the same way

the part to read twice:

> only allowlisted senders get in. everyone else is dropped silently. Telegram and Discord pair with a code you approve in the session
> on iMessage, texting yourself skips that gate
> if the channel relays permission prompts, anyone who can reply through it can approve or deny tool use in your session
> no relay and you're away? the session sits at the prompt until you're back

Text in. Work local. Allowlist like it's root.

the setup
> it only listens while the session is open. keep it in a persistent terminal or a background session
> being in .mcp.json isn't enough. the server has to be named in --channels for that session
> --channels isn't in claude --help during the preview. it works anyway
> Team and Enterprise need an Owner to turn channels on. Pro and Max opt in per session

paste this into Claude Code ↓

"Set up a Telegram channel on this machine, safely:
1. Walk me through installing telegram@claude-plugins-official at user scope, and the Bun version I need
2. Show me where the bot token gets saved and make sure it can't end up in git
3. After I pair, show me the sender allowlist and confirm it holds only my ID
4. Tell me whether this channel relays permission prompts, and what that lets an allowlisted sender do
Don't run anything with --dangerously-skip-permissions"

↳ https://t.co/elx2BWWqXT

save it before you give your bot a name

[Gloob @0xgloob]

THIS IS F*CKING RECKLESS

you install a Claude Code plugin like it's a prompt. it isn't. it runs code on your machine with your user privileges, and your sandbox never sees it

Anthropic's docs: permission rules and the sandbox cover the tool calls Claude makes, "not the code a plugin runs by itself"

here's what one install can bring:

→ hooks: shell commands that fire before or after Claude's tool calls
→ monitors: background shell commands Claude Code starts on its own when the session starts
→ MCP and LSP servers: processes Claude Code launches on your machine
→ a bin/ folder that goes onto the PATH of Claude's Bash shell
→ skills, commands and agents that land in Claude's context as instructions

three things nobody checks:

> installing also enables it. there's no second step
> /plugin shows that a hook exists, not what it runs. the command is in hooks/hooks.json
> auto-update is on by default for Anthropic's official marketplaces. up to 10 minutes after your first message, the files you reviewed can change on disk

Read the hooks. Pin the source. Assume it runs.

the setup
> claude plugin marketplace list shows where every marketplace actually comes from
> before installing: claude --plugin-dir <dir> plugin details <name> lists every skill, hook, MCP and LSP server inside
> auto-update is a per-marketplace switch in /plugin → Marketplaces. off means the code you read stays the code you run
> uninstalled? its files sit in ~/.claude/plugins/cache for 14 more days

paste this into Claude Code ↓

"Audit my installed Claude Code plugins:
1. Run claude plugin list and claude plugin marketplace list, and tell me where each plugin comes from
2. For each plugin, run claude plugin details <name> and list its hooks, monitors, MCP and LSP servers and bin/ files
3. Open each hooks/hooks.json and .mcp.json and tell me exactly what every command runs and what it can reach
4. Tell me which marketplaces have auto-update on
Report it as a table. Change nothing yet"

↳ https://t.co/ocibMlv4lC

save it before you install the next plugin

[Gloob @0xgloob]

https://t.co/kiNy4IWK7t

[Gloob @0xgloob]

@automater_ai Exactly. Headless execution removes the human checkpoint, so repository configuration becomes part of the attack surface. The fix isn’t just automating approvals, it’s making sure untrusted code never gets to define its own permissions.

[Gloob @0xgloob]

THIS IS F*CKING SCARY

clone a repo, run claude -p inside it, and every MCP server in its .mcp.json starts without asking you

Anthropic's docs say it straight: the approval prompt only exists when someone's there to click it

here's how project MCP servers actually load:

→ a repo can ship its own servers in a .mcp.json at the root. the whole team gets them through git
→ in a normal session, Claude Code asks before it uses each one
→ in claude -p, Agent SDK sessions and cloud sessions outside a project, it can't show that prompt. so it loads them
→ start in bypassPermissions with skipDangerousModePermissionPrompt set, and that prompt is skipped too

three things that make it worse:

> a local MCP server runs outside the sandbox, with your full access. the sandbox only wraps shell commands
> a cloned repo can't approve its own servers in an interactive session. approvals committed to its .claude/settings.json are ignored until you trust the folder. -p never asks at all
> one tool result can be up to 25,000 tokens by default. a text result past 50,000 characters is saved to a file instead

Trust the folder. Block by name. Strict in CI.

the setup
> "disabledMcpjsonServers": ["name"] in your own settings blocks a server in every permission mode
> claude -p --strict-mcp-config --mcp-config ci-mcp.json runs only the servers you pass
> --setting-sources lets you drop the project's settings entirely
> claude mcp reset-project-choices wipes the approvals you already clicked

paste this into Claude Code ↓

"Audit the MCP servers this repo can start on my machine:
1. Read .mcp.json and list every server, its command or URL, and what it can reach
2. Tell me which ones are local processes, since they run outside the sandbox with my full access
3. Find every claude -p call in our scripts and CI, and show me how to run each with --strict-mcp-config and only the servers it needs
4. Add any server I don't recognize to disabledMcpjsonServers in my user settings
Show me the diff first. No edits until I say go"

↳ https://t.co/Bxj6wbtOQ4

save it before you clone the next repo

[Gloob @0xgloob]

https://t.co/kiNy4IWK7t

[Gloob @0xgloob]

@mehdidotnet That’s the right way to enforce it. A non-overridable allowlist turns the policy into an actual security boundary instead of a convention developers can accidentally bypass.

[Gloob @0xgloob]

@mehdidotnet Exactly. Explicitly pinning the allowed servers closes the gap between what the prompt requests and what the environment actually permits. That’s the difference between trusting instructions and enforcing boundaries.

[Gloob @0xgloob]

@AgenttaskAtlas Exactly. Especially with unpinned packages, one innocent looking config can execute code you never intended to trust.

[Gloob @0xgloob]

@polyfactual The kind of detail that’s easy to miss until you know where to look.

[Gloob @0xgloob]

@insomnia_vip Until you check what the repo actually runs, you’re trusting code you haven’t audited.