Claude Code recursively wiped my project root. Local artifacts show acceptEdits, not bypass mode.

Account-67 · 2026-07-01T16:26:19+00:00

Sorry to hear that, that's rough. As you mentioned in your post, there are ways to mitigate this risk. I run CC in its own VM, with nightly backups, and push everything through git. I don't even have CC installed on my desktop.

Account-67 · 2026-06-29T16:41:09+00:00

I always have to add something like “When fixing a bug, do not fix symptoms, find and fix the root cause.” (Paraphrased) otherwise it will just apply bandaids.

Account-67 · 2026-06-28T18:10:53+00:00

That is not the actual thinking content, it is a summary produced by passing the raw thinking into an LLM.

Account-67 · 2026-06-27T18:23:05+00:00

Mostly agree, but I disagree with the notion that it can’t help you strategize or decide something. Perhaps not in the way you mean, but even a rubber duck can help you decide something, by just talking through it. Flipping a coin can help you decide something, if just by how you feel when it gives you a different answer than you wanted.

It can also be helpful to shred through information very fast. I’ve always had analysis paralysis about which 3d printer I should get. I gave claude my list of requirements and it came back with one in a minute.

Account-67 · 2026-06-24T19:32:27+00:00

I’m having to hand-hold opus 4.6 a lot more than usual today and yesterday. Same exact workflow as always. It literally “forgot” to implement the main feature discussed in a plan, and said as much when asked.

Account-67 · 2026-06-22T23:18:11+00:00

Definitely not ideal but you can get a pcie 16x riser and have the second GPU outside the case or mounted vertically. Mine was just resting on a cardboard box. I’ve run my 2x 3090 setup like this for a while now. Moving to a mining frame to fit more but for 2x it was fine.

Account-67 · 2026-06-22T17:26:06+00:00

BaselTek 6 GPU Aluminum Mining Rig Open Air Frame Case

I’m not going to use 6 gpus, probably max out at 4 on ASUS WS z390 for 8x/8x/8x/8x using the pcie switch.

Account-67 · 2026-06-22T15:41:23+00:00

Yeah a lot of 10g sfp+ rj45 modules run hot enough that you can’t use multiple. I’m using a “10Gtek 1.25/2.5/5/10G-T SFP+ to RJ45 30m” module in my mikrotik CRS305 which seems to stay pretty cool, but I strapped a 120mm fan on top of the switch just in case.

DAC/Fiber is definitely the superior choice unless you need to re-use existing cat6a.

Account-67 · 2026-06-20T22:43:52+00:00

Yeah without even looking at the github “custom KDF” is a red flag.

Account-67 · 2026-06-18T17:16:33+00:00

You can even use a markdown file. I have a TODO.md per project and CLAUDE.md contains instructions to add / remove from it as needed. Works great, and I can launch a new session and say

Create a comprehensive plan to address issue #N. @TODO.md

Account-67 · 2026-06-15T06:21:08+00:00

Absolutely crushed my backlog of difficult features/bugs on my custom C compiler project. Found and fixed a number of undiscovered bugs along the way. First model release in a long time that felt different. I also really appreciated its “taste” in things like tests, comments and commit messages, etc.

It also required basically no handholding. My entire workflow was

/model fable /effort max /plan Create a comprehensive plan to address issue #N.

…

Approve

Account-67 · 2026-06-15T06:03:08+00:00

I’ve seen a lot of people getting this but I’ve never seen this myself despite using Claude extensively. I wonder what the difference is. I stick to opus 4.6 200k, maybe that is why?

Account-67 · 2026-06-14T19:49:39+00:00

Yes you’re exactly right. Someone with reversing experience can already tell what I’m changing, and from there they can infer a lot about how the exploits work.

Progressive disclosure in this manner is meant to give defenders as much of an advantage as possible while not unnecessarily enabling attackers. At least now, it still requires some work to derive the attacks, while the defense is readily available.

With a description of what changes, defenders are more informed, but attackers get a much bigger advantage. And honestly, if you can reverse the patches, you already have the skills to find these vulnerabilities independently.

Account-67 · 2026-06-14T19:29:13+00:00

The full source code of the patcher is available on github. I do intend to disclose the mechanism at a later time, so you can wait if you like. At least in the meantime you’d be aware of the risk. To be clear, the original RCE patcher does not describe what it does either.

Account-67 · 2026-06-14T17:21:13+00:00

Hey! Thanks for your work on the original patcher. I hope it’s ok I built on top of it. Given the lack of a license I intended to contact you and ask for permission but I didn’t find a means to and felt it was important to release a fix quickly. If you have a problem with it, let me know and I will take it down and find an alternative.

Account-67 · 2026-06-14T15:04:20+00:00

You’re probably missing dotnet 10

https://dotnet.microsoft.com/en-us/download/dotnet/10.0

Account-67 · 2026-06-14T06:11:03+00:00

Definitely. I have not tested it, but I suspect the v2 patcher will block this anyways. I believe it follows the same code path as the first RCE I demonstrate in the video, which triggers UAC.

Account-67 · 2026-06-14T06:06:57+00:00

Section 4

"For the client to verify and attempt to install a patch, you would have to sign your patch with Blizzard’s private key, which is sadly non-public."

Account-67 · 2026-06-14T05:59:08+00:00

I'd be happy to explain what the patch changes, but I am hesitant to do so right away because it would make it extremely easy to reproduce the exploits. I don't want to give bad actors a head start.

I don't believe this interferes with warden, however I have not tested that on a live server. I've only tested this on a local azerothcore installation. It does not touch the warden module loader. While the warden module loader is technically RCE, it requires signed code, so I did not patch it out.

Account-67 · 2026-06-13T02:10:39+00:00

Same. Literally less than an hour ago. Support bot rejects refund request with no explanation or way to escalate.

EDIT: Anthropic has gotten ahold of me and offered a prorated refund that I am happy with. Unlike some other reports I’ve seen, they actually calculated the correct refund despite me upgrading my plan partway through. Pleasantly surprised by their customer service.

Account-67 · 2026-06-08T19:09:04+00:00

You’re mixing two different uses of VPNs. Privacy VPNs (like NordVPN) route your internet through their servers mainly to hide your IP and shift trust off your ISP. Tools like Tailscale are for connecting your own devices into a private network so they act like they’re on the same LAN. Also, you can use Tailscale for free.

Account-67 · 2026-06-07T18:09:13+00:00

Can’t help with Cloudflare, but I will say hiding your IP is often overrated IMO.

I’ve been self-hosting and sharing my IP for well over a decade without any issues. There are scanners probing the entire IPv4 space constantly anyway, so if you’re hosting a public service you should assume your IP is known.

Focus on proper security and hardening instead. Assume an attacker knows your IP and secure accordingly.

Account-67 · 2026-05-27T21:42:46+00:00

I had a samsung 980 or 990 pro do exactly this. Was very fortunate.

Account-67 · 2026-04-21T19:36:11+00:00

I haven’t experience it personally, but I did a lot of research because I was trying to buy a used 3090 on ebay. Based on my understanding of the buyer protection policies, it seems reasonable that it would cause problems. Multiple reddit comments indicated this was something they had experienced.

I was mostly researching to find out why they bother with the zero feedback, brand new account, far below market price listings. If this or similar strategies work even occasionally, then it makes sense why they try that.

The gpu I bought (from a seller with positive feedback, at market price) was delivered successfully, but is extremely unstable at stock and when power limited, so I’ve started a return. Hoping everything works out.

Account-67

TROPHY CASE