Claude's New Pet Feature Hacked in Less Than a Day: Community Releases Source Code for Re-Roll Tool, Turning Common into Legendary in a Blink

According to 1M AI News monitoring, shortly after the Claude Code's new pet feature/buddy system went live, the developer community discovered a re-roll method from leaked source code. Open-source tools and tutorials have since spread on platforms like Linux.do, V2EX, GitHub, etc.

Currently, there are at least two re-roll paths. One targets a fixed salt value in the pet generation algorithm, a value hardcoded with 15 characters in Claude Code's compiled output, allowing the random seed to be changed through a same-length substitution, enabling the discovery and writing of the desired pet's value after brute-forcing. The other exploits an authentication path difference: when a subscribed user logs in normally, the accountUuid issued by the server serves as the pet seed and cannot be tampered with; however, when authenticated via environment variables, this value is not written to local configuration, prompting the system to instead read the freely editable userID field.

The method of changing the salt is the most vulnerable, as it will be overwritten in the next Claude Code update. Altering the userID also has a shelf life for subscribed users, but Anthropic can patch by implementing the accountUuid writing logic for the environment variable path. API users (using their API Key for authentication) naturally lack an accountUuid and can directly modify the userID, offering a relatively longer window, yet Anthropic can likewise block this by generating a stable identifier through API Key hashing. Skeleton data is not stored locally, recalculated at each startup, allowing any server-side patches to take immediate effect.

Furthermore, the userID does not solely serve the pet system. The leaked source code reveals that telemetry reporting and A/B testing grouping also rely on reading this value, and modifying it could result in abnormal behavior of experimental features or data discontinuity.