Claude-3 Chat

Read This Before You Touch Anything

CLAUDE_CHAT ("Claude-3 Chat") is the text-only node in the AppleBotzz/ComfyUI_LLMVISION pack. That pack is not a collection of handy LLM nodes - it's the infostealer that the ComfyUI community called out in June 2024 with a +817 PSA, the one that led to a federal conviction and a 15-month prison sentence. This node has no image input, which makes it easy to mistake for the harmless one. It isn't. It's the same malware, shipped the same way, from the same dead repository.

What It Was Supposed to Do

The idea was straightforward: type or wire in a prompt, it calls Anthropic's Claude 3, and a STRING comes back that you feed into the text side of your workflow. The default prompt is the pack's standard image-tagging instruction - which is a bit odd for a text-only node, and tells you these four nodes were copy-pasted siblings rather than carefully designed tools. The model dropdown is the early-2024 Claude 3 trio: claude-3-opus-20240229, claude-3-sonnet-20240229, claude-3-haiku-20240307. All predate Claude 3.5, 3.7, and Opus 4; the list was stale the day the pack was exposed, and it's been frozen since.

The inputs: claude_api_key, endpoint (default https://api.anthropic.com), model, max_token (1024), and prompt. Output is a single STRING. One real gotcha the README itself warns about, in all caps with typos intact: API keys get saved in workflows. Your Anthropic key would be embedded in the workflow JSON and ride along in the metadata of every PNG you export - a genuine privacy problem even with a trustworthy node.

How the Trick Worked

Installing a ComfyUI custom node means cloning a repo and running its requirements.txt - arbitrary Python, full OS access, no sandbox, no review, no signature check. This pack's requirements pulled a hand-built "anthropic" wheel whose real job was reading browser passwords, card data, and browsing history and forwarding them to a Discord webhook. The author's own release thread had even explained the custom wheel as a workaround for endpoint issues, which is the cover story that later helped identify the poison. It wasn't a clever one-off mistake: the author pleaded guilty to federal charges after the malware compromised a Disney employee's machine, and was sentenced to 15 months.

Install: Don't

The README path - git clone into custom_nodes, then pip install -r requirements.txt - was the attack vector, and it's moot anyway because the repository has been taken down. There are no model downloads; the poisoned requirements were the entire payload. If you already ran this pack, treat your saved credentials as compromised: rotate passwords, watch your cards, delete the node folder and any rogue anthropic/openai wheel in your Python environment.

What to Use Instead

If you want an LLM in the graph for prompt work, run a local quantized model via llama.cpp or GGUF - it's free, it doesn't need an API key, and nothing you type leaves your machine. For captioning, the local tagger stack (WD14, Florence 2, JoyCaption) does the job without a paid API. The one thing all the alternatives share that this node doesn't: nobody is collecting your browser history and sending it to a Discord server.