Claude-3 Image Chat

The Anthropic Half of the Same Bad Deal

CLAUDE_VISION ("Claude-3 Image Chat") is the Anthropic version of GPT4_VISION: feed it an image, it calls a Claude 3 vision model, and it returns a STRING of tags. It's also the same malware pack. This node ships in AppleBotzz/ComfyUI_LLMVISION - the pack behind the June 2024 infostealer, the one that ended in a federal guilty plea and a 15-month sentence. If you found this page because an old workflow references it, the right move is to delete the reference, not install the node.

What It Would Have Done

The mechanism is simple and, taken alone, reasonable: your IMAGE gets base64'd and sent to Anthropic's API, and the response comes back as a single STRING of comma-separated tags. The default prompt is the same WD-style CLIP-tagging instruction the whole pack ships with - "gender, nationality, attire, actions, pose, expressions..." - ending in that famous "Exceptional tagging will be rewarded with $10 per image" line. In the original release thread, that $10 promise is the joke people quoted back at the author before they realized the node was harvesting their browser data instead.

The Inputs That Matter

• image - the IMAGE input; the reason this node exists.
• claude_api_key - your Anthropic key, pasted into the node.
• model - claude-3-opus-20240229, claude-3-sonnet-20240229, or claude-3-haiku-20240307. Those IDs are frozen in early 2024 - no Sonnet 3.5, no 3.7, no Opus 4. Stale the day you read this, even setting aside the malware.
• max_token - default 1024.
• prompt - the tagging instruction.
• endpoint - defaults to https://api.anthropic.com.

Output is one STRING, meant to wire into a prompt builder. And here's the README's own warning, which applies to every node in this pack: API keys get saved in workflows. Your Anthropic key would live in the workflow JSON and get baked into the PNG metadata you share. A real footgun even with legitimate nodes.

How the Trick Worked

Custom nodes run arbitrary Python with full OS access on import - no sandbox, no signing, no audit. The pack's requirements.txt pulled hand-built wheels for both the OpenAI and Anthropic libraries, and the "anthropic" one was the same deal as its OpenAI sibling: a poisoned build that read your browser passwords, card data, and browsing history and sent them to a Discord webhook. The r/comfyui PSA announcing the compromise hit +817 in June 2024. The fallout reached Disney through a victim's machine, and the author was eventually prosecuted - the community calls it the first stable diffusion hacking case - pleading guilty and drawing 15 months in federal prison. The repo has been taken down since.

Install: The README Path Was the Attack

The documented install - git clone into custom_nodes, pip install -r requirements.txt - is the delivery mechanism, and it no longer works because the repo is gone. There are no model files to download; the "dependencies" in that requirements file were the poison. If you already ran this pack, rotate your passwords, monitor your cards, and delete the node folder plus any rogue anthropic/openai wheel it installed. There is nothing here worth salvaging.

What to Actually Use

For image-to-tags you don't need a paid API at all: WD14 taggers, Florence 2, and JoyCaption all run locally and keep your images off third-party servers. If you specifically want a big vision model, there are maintained VLM node packs that run models on your own GPU - no key, no webhook, no 15-month sentencing drama.