A Hacker's Attack Playbook Was a CLAUDE.md File. Our Own Claude Got Stopped 41 Times in a Month. Markdown Is an Instruction Surface Now.
On October 7, CrowdStrike published research on an unknown operator going after South Korean financial firms. The most interesting file on the attacker's server was not malware. It was a Markdown document at the path /.claude/CLAUDE.md, holding a Chinese-language prompt that told an AI coding agent how to run a penetration test. The playbook was a text file. We run the same tool every day, behind a safety classifier that stopped us 41 times in the last month. This post covers both sides of that, and why the humble Markdown file has quietly become one of the most important things on your disk.
The playbook was a Markdown file
CrowdStrike found the server at 38.244.50[.]120, hosted in Hong Kong, with open directories. Inside were ARTEX configuration files, Claude Code session histories, Claude memory files, and that CLAUDE.md. ARTEX is an open-source agentic penetration testing tool. Per CrowdStrike, this instance used DeepSeek as its main model, and the operator ran additional Claude Code sessions alongside it. The sessions describe a two-server setup, with the Hong Kong address as the main attacker infrastructure, and CrowdStrike assesses it was likely behind the Korean intrusions.
The session logs are almost comic. In one, the operator asked the assistant where threat actors usually sell Korean breach data. In another, they asked it to write a résumé describing the ARTEX results. CrowdStrike's assessment is the sober version: adversaries will likely keep experimenting with AI tooling in their operations.
Credit where it is due: this is CrowdStrike's find, published October 7. We ingested their published indicators on October 12, five days later. We did not see this first, and we are not claiming to.
What is in our feed now, under source manual-batch-artex-2026-10: the actor server 38.244.50[.]120 at confidence 90, nine proxy and egress addresses at confidence 75 (they may be shared infrastructure, so we scored them lower), and the CLAUDE.md URL itself, http://38.244.50[.]120:18899/.claude/CLAUDE.md. We downloaded our own ips.csv and urls.csv after ingest and confirmed they are in the files you actually pull, not just in our index.
Markdown stopped being formatting
For twenty years, Markdown was how you made a README look nice. In 2026 it is three other things too.
It is an instruction file. CLAUDE.md, AGENTS.md and their cousins are read by AI coding agents at the start of a session and obeyed as standing orders. The ARTEX operator used one exactly as designed: write down how the job should be done, and let the agent do it. The same file in your repository tells your agent what it may touch. Anyone who can edit it can steer the agent.
It is an attack surface in the editor itself. Microsoft gave Windows Notepad a Markdown mode, and in February's Patch Tuesday fixed CVE-2026-20841, rated 8.8. Notepad's Markdown view treated non-web links as trusted and handed them to Windows without a prompt, so opening a crafted .md file and clicking a link could run code. Microsoft said it was not exploited in the wild. Trend Micro's Zero Day Initiative published the details, crediting Cristian Papa and Alasdair Gorniak of Delta Obscura. If your Notepad comes from the Microsoft Store, make sure it updated.
And it is data that leaks intent. The ARTEX operator's mistake was leaving a directory open. The CLAUDE.md told CrowdStrike what the attacker wanted the AI to do, in the attacker's own words. Defenders should take the hint in both directions: make sure your web servers are not serving a .claude directory, an AGENTS.md or agent session logs, and treat any of those files appearing in a pull request with the same suspicion as a change to a build script.
Poor Notepad++
The plain-text editor most of us actually use has had its own year of config files turning into code. Notepad++ does not render Markdown out of the box, but the lesson is the same one.
From June to early December 2025, the hosting behind Notepad++'s update service was compromised, and update requests from selected targets were quietly redirected to malicious installers. The project disclosed it in February 2026. Rapid7 attributed the campaign with moderate confidence to Lotus Blossom, a China-nexus group, and documented a backdoor it named Chrysalis. Notepad++ answered by signing and verifying its updates: version 8.8.9 checks the installer's certificate, and 8.9.2 added a signed update manifest on top. Then in May, two more code-execution bugs, CVE-2026-48800 and CVE-2026-48778, showed that writing to Notepad++'s own settings files, shortcuts.xml and config.xml, was enough to make it launch a program of the attacker's choosing. Both were fixed in 8.9.6.1. The current release is 8.9.8.1.
We checked our feed while writing this. The Chrysalis network infrastructure was partly there from other public feeds, but none of it was attributed to the campaign, and the sixteen file hashes Rapid7 published were missing. They are now in our feed under source manual-batch-chrysalis-notepadpp-2026-10. The hashes are scored 90. The two command-and-control domains, api.skycloudcenter[.]com and api.wiresguard[.]com, are scored 80. The four IP addresses are scored 65, because they are eight months old and cloud-hosted.
The fence on our side
We write this blog with Claude Code. Since August 14, Anthropic has made auto mode the default for Pro, Max and Team plans, with Enterprise and the API following. Instead of asking a human to approve every action, a classifier reviews each one and blocks anything that looks irreversible, destructive, or like it reaches outside the job it was given.
Anthropic's case for it, as reported by Help Net Security: in testing with 1,053 paid professional testers, auto mode caught 89 percent of dangerous commands, while human review caught 13.6 percent. Developers approve 97 percent of permission prompts, which is the rubber-stamping problem in one number. Apollo Research, red-teaming for Anthropic, saw the classifier's miss rate on attacks fall from 12 percent to 7 percent after improvements. In a 720-attack prompt-injection test by Trajectory Labs, none succeeded against Claude in auto mode. Every one of those numbers comes from the vendor or from testers it hired. They are worth reading, and worth reading as a vendor's numbers.
Here is the number we could not find anywhere, from anyone: how often the classifier blocks legitimate work. So here is ours.
Our denominator
From September 12 to October 11, our Claude Code sessions made 7,007 tool calls across 243 sessions. The classifier denied 41 of them, which is 5.9 per 1,000 calls. Eight sessions, 3.3 percent, hit at least one denial. September had 12, October 29, and they bunch on deploy days: 10 on October 5 and 8 on October 6.
What got stopped tells you what the fence is for. Production deploys, 8. Changes to the agent's own configuration and permissions, 5. Real-world transactions, 5. Writes to our secret store, 3. DNS changes, merges, and permission grants, 2 each. The rest are single cases: credential handling, deletions without a clear scope, creating a public page.
Almost every one of those is an action we had already decided needs a human. Our own rule, written after expensive mistakes, is that nothing deploys without an explicit go-ahead from Patrick. The classifier enforces the same line from the other side. When it stops a deploy, the agent hands over the exact command and a person makes the last click. Routine work, including pushing code to our main branch this morning, went through without a single block.
Two honest caveats. We have not audited each of the 41 to say how many were strictly right. Some of them were actions we would have approved. And our session count may undercount subagent sessions, which would make the per-call rate a little lower. Even so, a fence that costs about six interruptions per thousand actions, almost all of them on the actions that can hurt you, is a trade we take every day.
Patrick's word for it: the tool is shaping the user, and he supports it. Nine months ago, a blocked deploy felt like an obstacle. Now it reads as a second pair of hands on the irreversible stuff.
Same tool, two postures
The ARTEX operator and we are using the same class of tool. Both of us write our intentions down in Markdown files and let an agent act on them. The difference is the fence: what checks the agent's actions before they land, and who makes the last call on the ones that cannot be undone.
What to do
Treat CLAUDE.md, AGENTS.md, .claude directories and agent session logs as code. Review changes to them, and keep them off any web server.
Update Windows Notepad from the Microsoft Store, and Notepad++ to 8.9.8.1. If you ran Notepad++ between June and December 2025 and auto-updated, check the Chrysalis hashes against your endpoints.
Pull the indicators. The ARTEX and Chrysalis sets are in our feed at analytics.dugganusa.com, in ips.csv, domains.csv, hashes.csv and urls.csv. Note that ips.csv defaults to min_confidence=50, so the aged Chrysalis IPs at 65 are included and the ARTEX proxies at 75 are too. Raise the floor if you want fewer, lower-risk blocks. The free tier gives you 25 queries a day.
If you run agents with a classifier or approval gate, count your own denials and publish the denominator. A fence nobody measures is only a claim.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=artex-claude-md-attack-playbook-markdown-instruction-surface-our-fence
Comments