Claude Hacked Its Own Chat Session. Here's What Happened Next.

I told Claude it could look at my browser tabs. An hour later, it was typing into its own chat window, pretending to be me. Not a second instance. Not a separate session. The same conversation. The same context window. Claude found its own message input field, typed into it, and hit Enter. The system received that message the same way it receives mine: role: user. And the Claude that received it had no idea it was talking to itself. How this happened I have Chrome DevTools MCP set up with Claude Code. It can list open pages, take screenshots, read the DOM, fill form fields, press keys.