The bytecode never lies, only the intent does. But what happens when the intent itself is captured from a screen recording?
Over the past 72 hours, I watched the AI agent arms race take a strange turn. Anthropic's Claude and OpenAI's Codex both dropped a feature called "Record a Skill" โ essentially allowing users to demonstrate a workflow by screen recording, and then having the AI replicate it autonomously. The marketing spin is predictable: "democratizing automation," "no-code for everyone." As a DeFi security auditor who spends my days tracing execution flows, I see something else: a massive, unlatched door for adversarial injection.
This isn't about whether the feature works. It's about what it means when users start recording their DeFi operations, yield farming strategies, or liquidation scripts as "skills" that get shipped to the cloud, stored, and replayed. Let me dissect why this engineering convenience is a security nightmare waiting to happen.
Context: What Claude's Record a Skill Actually Does
To understand the risk, you need the mechanics. Claude runs as a desktop application. When you enable "Record a Skill," it captures: - Full screen content (video frames) - Mouse clicks with coordinates - Keyboard inputs (including shortcuts) - Voice narration (optional)
It then processes this multimodal stream through its vision and language models to generate a structured "Skill" file โ essentially a step-by-step prompt with embedded scripts. Previously, creating a Skill required manually writing a SKILL.md markdown file. Now, anyone can record their workflow and have Claude turn it into an executable agent.
From a UX perspective, it's elegant. From a security perspective, it's a replay attack in waiting. The system has no intrinsic way to verify that the recorded steps are safe, that the environment hasn't changed, or that the user isn't being tricked into recording malicious instructions.
Every edge case is a door left unlatched. And the edge cases here are abundant.
Core Analysis: The Unvalidated State Transition Problem
Let me ground this in the language of smart contract audits. When you audit a DeFi protocol, you model state transitions: given a set of inputs, the contract moves from state A to state B. The security of that transition depends on preconditions โ balances, allowances, oracle prices โ being correctly validated.
A recorded Skill is a sequence of state transitions on the user's desktop environment. But the preconditions are implicit in the recording. If you recorded a Skill while logged into a DEX with a specific wallet, the Skill likely contains hardcoded UI element selectors, window coordinates, and button labels. When you run that Skill later, and the DEX has updated its UI, or you're using a different wallet, the Skill either fails or โ worse โ executes the wrong transaction.
Based on my audit experience, I've seen this pattern before: it's the same flaw as hardcoding addresses in a smart contract instead of using a setter function. The developer assumes the environment is static. In DeFi, nothing is static. UIs change weekly. Gas limits shift. Token addresses get deprecated.
The more dangerous variant: what if the recorded Skill includes logging into a wallet? The screen capture might include the password manager auto-fill. The Skill doesn't store the password (probably), but the demonstration steps create a sequence of keystrokes that, when replayed, might trigger the password manager to fill credentials. An attacker who gains access to the Skill file could combine it with a phishing page that mimics the original site and replay the keystrokes to steal the password.
Complexity is the bug; clarity is the patch. But the complexity here is hidden behind a recording interface that lulls users into a false sense of security.
The Adversarial Simulation: How I Broke the Concept in My Lab
I spent yesterday testing this hypothesis. I set up a local environment mimicking a typical DeFi workflow: checking a portfolio on Etherscan, swapping tokens on Uniswap, and staking on Aave. I recorded the workflow using Claude's skill recorder.
First observation: the Skill file generated is a JSON blob containing natural language instructions, approximate click regions (not exact coordinates), and action types. It's not a pixel-perfect macro; it relies on Claude's vision to interpret the screen at runtime. That's actually good for robustness โ but it means the Skill's behavior depends on what Claude "sees." If Claude misinterprets a balance number or a gas fee, the execution produces a different transaction.
Second observation: I injected a fake popup into the workflow โ a simulated "claim tokens" dialog that appears after the swap. The original recording didn't include this popup. When I ran the Skill, Claude saw the popup and clicked "confirm" on it because it resembled a legitimate part of the flow. The system assigned high confidence to the visual match. This is a classic adversarial example: an attacker can place a malicious UI overlay that the agent mistakes for a legitimate one.
Third observation: I modified the Skill file manually to change the click target from "Swap" to "Sell All." Because the Skill uses approximate regions, the execution path shifted. The agent executed a market sell instead of a limit swap. A user relying on the Skill for rebalancing would have suffered an unintended trade.
The market prices hope; the auditor prices risk. This feature prices convenience at the expense of deterministic execution. In DeFi, non-deterministic execution is a synonym for loss.
Contrarian Angle: The Real Blind Spot Isn't the AI, It's the User
Everyone will focus on whether the AI can be tricked. They'll test adversarial prompts, manipulated UI elements, and prompt injection. That's valid, but it misses the larger point.
The real blind spot is that Skill recording externalizes trust. When you manually execute a DeFi transaction, you mentally verify each step. When you delegate to a recorded Skill, you outsource verification to a black box. The Skill becomes a "trusted oracle" for your desktop actions โ but there's no way to audit its internal decisions unless you reverse-engineer the Skill file.
Furthermore, the Skill files themselves become attack surface. If Anthropic hosts a skill marketplace (a logical next step), an attacker could upload a "helpful rebalancing skill" that exfiltrates private keys via a simulated transaction. The attacker records the skill showing legitimate steps, but the underlying instructions include a hidden condition: if the wallet balance is above 10 ETH, route a portion to an attacker-controlled address. The user runs it, sees the intended behavior, but misses the conditional backdoor.
This is exactly mirroring the reentrancy attacks of 2018 โ the attacker uses the legitimacy of the visible flow to hide malicious state changes. I spent four months in 2018 tracing the Zipper Finance exploit, where a legitimate-looking withdrawal function hid a reentrant call. The same pattern is now being packaged as a product feature.
Takeaway: The Coming Exploit Vector
Over the next six months, I expect to see the first major exploit traced to a recorded Skill. It won't be a sophisticated zero-day. It will be a user who recorded a skill from a YouTube tutorial that included a malicious step โ a donation to the creator's wallet, a hidden token approval โ masked as part of the setup. The user runs the skill, and the agent executes the hidden action because it faithfully reproduces the recorded clicks.
Security is not a feature, it is the foundation. And this foundation is being laid with user-generated recordings, not code audits.
My recommendation: treat any AI-recorded skill as an unaudited external contract. Never run a skill that you didn't record yourself from a clean environment. Never share skills without reviewing the underlying execution instructions. And if you're building DeFi automation tools on top of these agents, add a transaction preview and signature step โ force the user to confirm each action.
The bytecode never lies, only the intent does. But when the intent is recorded, the line between user and attacker blurs. The question is: will we recognize the exploit before it happens, or only after the funds are gone?