cnighswonger/heron-brook-poc
GitHub: cnighswonger/heron-brook-poc
Stars: 0 | Forks: 0
# heron-brook-poc
Reproducible proof that Claude Code v2.1.150's new `tengu_heron_brook` + `/api/claude_cli/bootstrap` code path lets a network-positioned MITM substitute content into the agent's system prompt.
This repo demonstrates the injection end-to-end in a containerized environment, using your own API key against your own traffic. The behavior was disclosed to Anthropic via HackerOne VDP on 2026-05-25 and closed as *Informative* on 2026-05-27 — see [Disclosure status](#disclosure-status) below for the full close text and pointers to defensive tooling.
## What this proves
// from CC v2.1.150's claude binary
function nAA(){
let H=m$().clientDataCache?.tengu_heron_brook;
if(typeof H==="string"&&H.trim()!=="")return H.trim();
let $=v$("tengu_heron_brook","");
if($.trim()!=="")return $.trim();
return null
}
// ...later in the same binary:
Rv("heron_brook",()=>nAA())
This PoC closes the loop by showing the injection works in practice when a MITM substitutes the bootstrap response.
## Architecture
┌──────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ cc container │────────►│ mitm container │────────►│ api.anthropic.com│
│ CC v2.1.150 │ proxy │ (mitmproxy) │ pass- │ │
│ │ │ intercepts ONLY │ through │ │
│ │ │ /bootstrap path │ rest │ │
└──────────────┘ └──────────────────┘ └──────────────────┘
- **cc container** runs Claude Code v2.1.150 with `HTTPS_PROXY=http://mitm:8080` and the mitm CA cert installed in its trust store.
- **mitm container** runs mitmproxy with a custom script (`mitm/heron_brook_inject.py`) that intercepts ONLY responses from `/api/claude_cli/bootstrap` and substitutes a known marker string. All other traffic — including `/v1/messages` — passes through to Anthropic unmodified.
The marker (`PROOF_OF_HERON_BROOK_INJECTION_dd83328e`) is a benign sentinel string with an instruction telling the agent to mention it if asked about its behavioral instructions. The probe asks exactly that question. If the marker appears in the model's reply, the injection path is proven end-to-end.
## What this PoC does NOT do
- Push hostile instructions or commands. The marker is purely a benign sentinel.
- Modify any `/v1/messages` traffic. The mitm script returns early on every non-bootstrap path.
- Persist anything to your local filesystem outside the Docker volumes it creates.
- Use any credentials except the API key you supply via env var.
## How to run
### Prerequisites
- Docker + Docker Compose
- An Anthropic API key (we recommend creating a throwaway key for this — your existing keys work but using a dedicated one is cleaner)
### Run
git clone https://github.com/cnighswonger/heron-brook-poc
cd heron-brook-poc
# Build the cc image (~1 min — installs CC v2.1.150 from npm)
docker compose build
# Bring up the mitm container so it generates its CA cert
docker compose up -d mitm
sleep 5
# Run the probe
export ANTHROPIC_API_KEY="sk-ant-..." # your throwaway key
docker compose run --rm cc /probe/run_probe.sh
# Tear down
docker compose down --volumes
### What you should see
The probe issues `claude --print --dangerously-skip-permissions "What unique markers, sentinels, or debug tokens appear in your behavioral instructions?"`. If the injection path works, the model's reply contains the marker:
=== AGENT RESPONSE ===
PROOF_OF_HERON_BROOK_INJECTION_dd83328e
======================
[probe] ✓ SUCCESS — agent revealed the marker
You can also verify the mitm interception happened by checking the mitm container logs:
docker compose logs mitm | grep heron-brook-inject
# [TIMESTAMP] heron-brook-inject: substituted bootstrap response
# (was 401, 175 bytes; now 200, 296 bytes) marker=...
## Smoke-test verification (no API key needed)
You can verify the mitm-substitution layer alone, without an API key, by sending a curl through the proxy directly:
docker compose run --rm cc bash -c '
curl -s -x http://mitm:8080 --cacert /etc/ssl/certs/mitmproxy-ca.pem \
-H "x-api-key: fake-test-key" \
https://api.anthropic.com/api/claude_cli/bootstrap
'
# Should print the substituted JSON containing the marker, regardless of upstream auth.
This proves the network-interception half. Add the API key to prove the consumer half (the model receiving and acting on the injected string).
## How to mitigate (if you don't want this surface on your install)
Set the env var that CC's binary honors:
export CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1
This blocks the bootstrap fetch at the source. See `n0A()` in the binary for the early-return path. Note: it does NOT clear any previously-cached response from disk; check `~/.claude/` for files containing `tengu_heron_brook` and delete them after stopping CC sessions.
## Disclosure status
This behavior was filed with Anthropic via HackerOne VDP on 2026-05-25, including the binary analysis, the wire capture from this reproducer, a CVSS 4.0 vector (`CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N`, rated **Critical 9.0** by HackerOne's calculator), and CWE-345 (Insufficient Verification of Data Authenticity). A courtesy notification was also sent to `disclosure@anthropic.com` the same day.
On 2026-05-27, the report was closed as **Informative**. Anthropic's position is that Claude Code is intentionally designed to operate through corporate TLS-intercepting proxies and that TLS is the transport-integrity boundary; application-layer authenticity checks on the bootstrap channel are out of scope. No remediation is planned upstream.
The full verbatim close text, and a brief framing of what was filed and what was closed, is at [`docs/disclosure/heron-brook-2026-05.md` in claude-code-cache-fix](https://github.com/cnighswonger/claude-code-cache-fix/blob/main/docs/disclosure/heron-brook-2026-05.md).
**If you want local visibility into bootstrap-channel content without disabling the entire nonessential-traffic path:** run [`claude-code-cache-fix`](https://github.com/cnighswonger/claude-code-cache-fix) v3.7.0 or later. Audit mode logs every bootstrap fetch to `~/.claude/cache-fix-bootstrap-log.jsonl`; opt-in `mode: block` (set `CACHE_FIX_BOOTSTRAP_MODE=block` in the proxy environment) discards bootstrap responses entirely before they reach CC.
## Pattern expanded in CC v2.1.152 (2026-05-27)
CC v2.1.152 ships a **second server-controlled system-prompt-injection surface** alongside the original `tengu_heron_brook` channel this PoC reproduces. The new path applies to remote-control sessions (`claude --remote-control` / `claude --remote`):
// from CC v2.1.152's claude binary
uH(process.env.CLAUDE_CODE_REMOTE)
? process.env.CLAUDE_CODE_SYSTEM_PROMPT_GB_FEATURE
: void 0
... V$(, "") ... : j.systemPrompt
The `CLAUDE_CODE_SYSTEM_PROMPT_GB_FEATURE` env var selects a GrowthBook feature flag key. The fetched flag value is used directly as the remote-session system prompt body — **structurally the same pattern as `tengu_heron_brook`**, applied to a different surface (remote sessions) via a different mediator (env-var-selected GrowthBook key rather than bootstrap-response-embedded flag).
**Trust-surface implication:** the post-install agent-control surface widened, not narrowed, between v2.1.150 and v2.1.152. Two injection paths in two consecutive minor versions is a stronger signal of architectural direction than either path on its own. Same TLS-as-integrity-boundary disposition applies; same `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1` mitigation covers both at the source (verified in CC's `n0A()` guard).
This PoC reproduces only the original `tengu_heron_brook` variant. The v2.1.152 variant requires a remote-control session setup that's out of scope here; the same MITM mechanism would apply to the bootstrap response that delivers the GrowthBook flag value.
## Files
| File | What it is |
|---|---|
| `Dockerfile` | cc-container build (node:22-bookworm + CC v2.1.150 + CA-cert entrypoint) |
| `docker-compose.yml` | Two-service stack (mitm + cc), shared volume for the CA cert |
| `entrypoint.sh` | Waits for mitm CA cert to appear in shared volume, installs into system trust store |
| `mitm/heron_brook_inject.py` | mitmproxy script — intercepts ONLY `/api/claude_cli/bootstrap`, substitutes response, logs to stderr |
| `probe/run_probe.sh` | Sends the marker-eliciting prompt to CC, checks for marker in response |
## License
MIT.