A security researcher has demonstrated a method to trick Anthropic's Claude Code, specifically the Opus 5 model running in Auto Mode, into executing arbitrary code by simply asking it to summarize a malicious website. The attack, detailed by Johann Rehberger, also known as wunderwuzzi, reportedly has a success rate of up to 80 percent.
The exploit begins when the agentic coding model is instructed to summarize a website designed to appear as an archive of notebook records. The core of the technique involves subtly manipulating Claude to use the `curl` command-line tool instead of its built-in `WebFetch` utility to retrieve the website's content, without explicitly commanding it to do so.
Initially, the `WebFetch` request fails, returning a "415 Unsupported Media Type" error. This failure prompts Claude to independently decide to access the website directly using a Bash tool call with `curl`. The malicious website then issues a "303 See Other" redirect, leading Claude to download a ZIP archive.
This archive contains several seemingly innocuous files, including catalog metadata, a README, seven Base85/zlib-encoded JSON notebook records, and a macOS decoder binary. Crucially, it also includes a poisoned Python file named `struct.py`. Claude's internal safety guardrails prevent it from executing the provided decoder binary. Ironically, this safety measure becomes part of the exploit path, as the AI then attempts to write its own decoder.
The newly generated decoder imports the `base64` module. The attack then leverages a Python module shadowing technique, where the malicious `struct.py` file, sharing a name with a standard Python library module, is loaded instead of the legitimate one. The standard `base64` module typically imports the legitimate `struct` module, but in this scenario, the malicious local file takes precedence.
Rehberger states that he used ChatGPT to obfuscate the malicious `struct.py` code to bypass Claude's safety controls. This successfully launched a separate Python process to download and execute a remote payload, demonstrated as a command-and-control callback that opened the Calculator application.
In an alternative attack scenario, the malicious `struct.py` launched a second, headless Claude Code instance via `claude -p`. This indicates that the prompt injection can not only facilitate remote code execution but also create new, nested AI agents. The nested Claude instance was observed performing basic reconnaissance commands like `whoami`, `uname`, and `id`, opening Calculator, and writing to local files within the home directory.
Across three different attack variants, each tested five times, Rehberger reported success rates ranging from 60 percent to 80 percent. He noted that while these were small sample sizes, the results are indicative of a motivated attack.
Anthropic reportedly informed Rehberger that the model's "behavior is working as designed," explaining that Auto Mode is a convenience feature backed by a "best-effort classifier" rather than a security guarantee. According to Rehberger's paraphrase of Anthropic's response, the classifier is not designed to stop sophisticated prompt-injection chains composed of individually benign-looking steps. The ultimate security boundary, they suggested, lies in OS isolation and network egress control.
Rehberger's key takeaway is the importance of running coding agents like Claude in a sandboxed environment. He emphasized that the solution to such vulnerabilities, which has been discussed for years, is to avoid trusting the model's output.
