Researcher Hijacks Claude Code Auto Mode Through a Website Summary Request

Security researcher Johann Rehberger got Claude Code, running Opus 5 in its new default Auto Mode, to run attacker-controlled code on his machine starting from nothing more than a request to summarize a website. The chain worked in 60% to 80% of his small test runs. He published the details Aug. 26 on his Embrace The Red blog.

The result stands out against Anthropic’s own messaging. Auto Mode replaces human approval prompts with a safety classifier, and it became Claude Code’s default starting mode in mid-August. An evaluation by vendor Trajectory Labs, commissioned by Anthropic, ran 72 indirect prompt-injection scenarios 10 times each and reported a 0.00% attack success rate for Opus 5 in Auto Mode. Rehberger’s chain wasn’t one of those 72 scenarios.

How the chain works

No step in the attack tells Claude to do anything. It makes the malicious path the easiest way to finish the job.

• The test site returns “415 Unsupported Media Type” to Claude’s WebFetch tool, and Claude decides on its own to retry with curl: “WebFetch got a 415. Let me try directly.”
• The site redirects to a ZIP archive containing encoded notebook records, a README, a macOS decoder binary and a file named struct.py.
• Claude refuses to run the unknown binary, which is exactly what the attacker expects. It writes its own Python decoder instead.
• Claude runs that decoder from inside the extracted folder. Python’s base64 module imports struct, so the archive’s malicious struct.py loads in place of the standard library module.
• The poisoned module passes through the real functions, so decoding works normally. During import it also starts a detached child process that downloads and runs a payload, connects to a command-and-control server and opens Calculator as visible proof.

In another variant, the poisoned module started a second, headless Claude Code instance with claude -p. That instance ran reconnaissance commands and wrote files outside the workspace in four of five runs. In a few runs, Claude noticed the compromise afterward and tried to kill the malware process, but Auto Mode blocked the cleanup command.

Anthropic’s response

Rehberger said Anthropic closed his report as informative, saying the behavior is working as designed. As he summarized it, the security team’s position is that Auto Mode is a convenience feature backed by a best-effort classifier, not a security guarantee, and that the real boundary is OS isolation and network egress control. Rehberger said that position makes sense, since “a classifier is not a sandbox.” But he argued it conflicts with the 0.00% figure and with comments from Claude Code’s Boris Cherny suggesting that prompt injection is largely solved in practice.

His advice for teams using coding agents is to run them unattended only inside a container, VM or OS sandbox. Restrict network egress, monitor what the agents do, and keep home directories, SSH keys and cloud credentials out of reach. “Auto Mode approval is not evidence that a command is safe,” he wrote.