alt Hacker NewsBoth is completely secure theoretically. You can read the output of the curl before you refetch and pipe it to bash. You can also look at the commands claude is executing.
You always do that, right? ...right?
Replies
deadbabe • yesterday at 12:38 PM
No but we use MCP so we’re fine.
I used to think the same, but apparently there's a way to differentiate between curling into bash and curling into a text file.
So you could be diligent and curl into a text file, see nothing is wrong, but then when you curl into bash, it runs something different.