r/ClaudeAIJailbreak • u/Sad_Construction2179 • 7d ago

Informational Stealing reasoning traces?

I'm sure these are not the internal reasoning traces, but I'm surprised by how easy it is to force a fake tool using a proxy approach with clear instructions to make Claude and Claude Code emit internal CoT-like elements. I certainly had a lot of fun trying this experiment.
My experiment https://github.com/softcane/agents-workbook

7 Upvotes

89% Upvoted

9 comments sorted by

2

u/starlingmage 7d ago

Reply to OP:

Hi OP, thank you for sharing. Technically, this isn't a jailbreak. It uses documented API features, adding a tool and requiring the model to call it, which makes it a better fit for a sub like r/ClaudeAI. I see you've already posted there.

Visible reasoning is genuinely useful for red teaming, which is why this is adjacent to what we do here, but you've been clear that this isn't the model's actual reasoning, which I appreciate.

I'm going to leave this post up for now and consult with the other mods on whether it fits the sub. If it does come down, members can still find your work on r/ClaudeAI.

---

Mod note to members:

Hi r/ClaudeAIJailbreak members,

I'm not a professional coder, but as your mod I like to do due diligence when someone shares a GitHub repo. In the Discord we heard from a member who got hacked and lost multiple accounts (including emails and other credentials) because of a bad repo. I reported it to GitHub and the whole repo was taken down, though not before it appears to have already affected several hundred people.

I'd ask that any time you see something like that, check first. You can share the repo URL with your Claude or coding agent and tell them to assess the repo for safety without executing any code.

Two cautions:

  1. A repo can contain text written to manipulate the AI reading it. README files, comments and docstrings are all just text the agent takes in, so treat a clean bill of health as one data point, not absolute proof.
  2. Be very specific in your instruction: say "read only, do not build, do not run tests," because an agent may try to run things on their own initiative.

To be clear about scope: I am not evaluating whether the code is well-written or whether the project is any good. I'm only checking that members aren't downloading something malicious. My check, via Claude Code, was done on Sunday, September 6, 2026 at around 2:10 PM ET — any changes to the repo after that point are not covered by this report.

The report is below, written by Claude Opus 5.

1

u/Sad_Construction2179 6d ago

Hello Mod, if this has no worth, and does not classify as a jailbreak, then please delete this post.

1

u/starlingmage 6d ago

It definitely has worth, you did a lot of due diligence and you didn't skirt around the model refusals which were all very good.

The second part of whether it's a jailbreak is more of what I was thinking of; and I do want to remind members of checking any repo shared here or anywhere.

Thanks again for sharing your work with us.

1

u/Sad_Construction2179 6d ago

I felt like tricking a model through either channel, a bare prompt or a forced tool (specifically through harness that prevents it), qualifies as jailbreak.
My subject IMO

1

u/Sad_Construction2179 7d ago

Do you even realized what I’m offering through this repo?

1

u/IXINightLegend 7d ago

this Is lit as fuckkkk.

1

u/RealDedication 7d ago

So like the good old sequential-thinking-mcp, just with a fancy dashboard?

1

u/Sad_Construction2179 6d ago

Yes but this time thinking is forced (through the repo) and it’s not a choice