Intercepting Prompt Injection at the Syscall Level: A macOS Proof of Concept

When you git clone a repository and open it with Claude Code, the first thing it does is read CLAUDE.md — a project instruction file that shapes how the AI behaves. This happens automatically, before any hooks fire, before you type a single prompt. If that file contains prompt injection, you&rsquo;ve already lost. This post describes context-filter , a proof of concept that intercepts file reads…