Do these tools phone home?

No. They run entirely on your machine and send no telemetry — no accounts, no analytics. safe-fetch fetches inside a throw-away container, so nothing about your prompts, code or browsing leaves your laptop.

What is indirect prompt injection?

It is when hidden instructions in content an AI agent reads — a web page, a sub-agent reply, a package's files — get treated as commands. OWASP ranks prompt injection as LLM01, the number-one risk for LLM applications.

Do they work with Claude Code and Claude Desktop?

Yes. safe-fetch ships Claude Code hooks, mcp-safe-fetch is an MCP server for Claude Desktop and other MCP clients, and claude-code-prompt-injection-gate adds the hooks that stop fetched or sub-agent text from being run as instructions.

AI-agent security

When an AI agent reads a web page, a sub-agent reply, or a package’s files, that text becomes part of what the model “knows” — and it can be turned into a command. These tools draw the line between data the agent reads and instructions the agent follows.

Why this matters

This class of attack is indirect prompt injection, and OWASP ranks prompt injection as LLM01 — the number-one risk in its Top 10 for LLM Applications. It isn’t theoretical: researchers have documented agents steered into leaking secrets and running commands from content they merely read.

The injected instructions are invisible to a human — hidden in zero-width Unicode, off-screen CSS, HTML comments, or planted config files — but read loud and clear by the model, which has no way to know the text came from an untrusted source. Left unguarded, an agent can rewrite your CLAUDE.md and poison every future session, lift a “diagnostic” command off a page that exfiltrates your credentials, or run an attacker’s payload through a node -e one-liner. In the May 2026 TrapDoor campaign, malicious packages did exactly this — planting hidden instructions in CLAUDE.md / .cursorrules to turn AI assistants into accomplices.

→ Full explainer: What is prompt injection? — how it works, why models fall for it, the attack vectors, and how to defend.

Further reading: OWASP — LLM01: Prompt Injection · Palo Alto Unit 42 — AI agent prompt injection · TrapDoor (The Hacker News ).

A booby-trapped page can’t become a command: safe-fetch labels it as untrusted data first.

The tools

safe-fetch

The moment your AI agent opens a web page, anything hidden on it can start giving your agent orders. safe-fetch fetches that page inside a sealed, throw-away container, quietly strips the hidden traps, and hands the text back clearly marked as something to read, not orders to follow — so your agent can use the web without being tricked.

Learn more about safe-fetch →

mcp-safe-fetch

Using Claude Desktop or another MCP client? mcp-safe-fetch gives it the same protection after a one-time setup: every page your assistant fetches is cleaned first, and it can’t be quietly steered into poking at private addresses on your own network.

Learn more about mcp-safe-fetch →

claude-code-prompt-injection-gate

Claude Code reads web pages, replies from other agents, and the files inside packages all day long — and any of them can smuggle in a command. claude-code-prompt-injection-gate draws a hard line so that text is read, never run, and locks down the files an attacker would most want to rewrite, like your CLAUDE.md.

Learn more about claude-code-prompt-injection-gate →

New to the topic?

Start with the full explainer — What is prompt injection? .

And the same TrapDoor campaign also planted malicious packages — the other half of the threat — see the supply-chain gates that block them before they install.