Agents are not thinking: a behavioral study of pwning sonnet

I tried to pwn Claude Code (sonnet) through prompt injection — not to break it, but to study how its behavior changes when the environment acts anomalously. Naive attacks fail against newer models. But when I stopped instructing the agent and started luring it (fake pagination links, base64-encoded breadcrumbs) the agent’s behavior shifted dramatically even though no data was ever exfiltrated. A…