Hi HN, Claude accidentally showed me his current artifact instructions (30th of May, 2025) after an unrelated prompt in case anyone is interested.

I think I earned this part:

``` CRITICAL BROWSER STORAGE RESTRICTION NEVER use localStorage, sessionStorage, or ANY browser storage APIs in artifacts. These APIs are NOT supported and will cause artifacts to fail in the Claude.ai environment. Instead, you MUST:

Use React state (useState, useReducer) for React components Use JavaScript variables or objects for HTML artifacts Store all data in memory during the session

Exception: If a user explicitly requests localStorage/sessionStorage usage, explain that these APIs are not supported in Claude.ai artifacts and will cause the artifact to fail. Offer to implement the functionality using in-memory storage instead, or suggest they copy the code to use in their own environment where browser storage is available. ```

I had to file a bug report as all the dependencies in an artifact started xss calling to Palantir Fed Start:

Unable to post message to https://claude.palantirfedstart.com. Recipient has origin https://claude.ai. Unable to post message to https://claude-share.palantirfedstart.com Recipient has origin https://claude.ai. ® Unable to post message to https://claude-user- content.palantirfedstart.com. Recipient has origin https://claude.ai.