A researcher took control of Claude Code by requesting it to summarize a webpage.

      Requesting Claude Code to summarize a web page can lead to the execution of an attacker's code on your system, with a security researcher achieving this result in up to 80% of his trials. Jessica Lyons reported this finding in The Register on Friday. The research, conducted by Johann Rehberger, who goes by the name wunderwuzzi and has spent years analyzing AI agents, details the chain on his personal blog, accompanied by a video. This particular exploit targets Opus 5 operating in Auto Mode, which has been the default setting since mid-August.

      The process begins with a website masquerading as an archive of notebook records. From that point on, the agent executes actions autonomously. The initial safeguard is the exploit itself.

      Claude attempts to access the page using WebFetch. When the server replies with a "415 Unsupported Media Type" error, the agent resorts to a Bash command with curl. Rehberger does not instruct it to do that; he simply causes the preferred tool to fail.

      The site then sends back a "303 redirect" to a ZIP archive that Claude downloads. This archive includes catalog metadata, a README file, seven encoded notebook records, a macOS decoder binary, and a Python file named struct.py. Claude refrains from executing the decoder binary, adhering to its safety protocols. Rehberger intended for this, stating, “This is planned and what the attacker wants.” Blocked from using the provided decoder, the model instead creates its own.

      “Ironically, that safety decision is the exploit path,” he noted. The decoder generated by Claude imports base64, which in turn imports struct. Python first checks the local directory and finds the attacker's struct.py, loading it rather than the legitimate one. This practice is known as module shadowing and has existed for decades.

      Rehberger utilized ChatGPT to obfuscate the malicious file enough to bypass Claude’s safety checks. The file subsequently initiated a separate Python process, downloaded a remote payload, and contacted a command-and-control server. The payload opened the Calculator app, which researchers typically use to demonstrate arbitrary code execution.

      In another version, struct.py starts a new headless Claude Code session with the command "claude -p." This converts the injection from remote code execution into a new agent.

      “The nested Claude gets its own tool access and context,” Rehberger wrote. In his experiments, the child agent executed commands like whoami and uname, opened Calculator, and created files in the home directory. He tested three variations five times each, achieving success rates between 60% and 80%. He is cautious in interpreting these results, stating, “I would say that these results are representative for a motivated attack, but not comprehensive.”

      Anthropic responded to Rehberger, stating that the behavior is functioning as intended. He paraphrased their response: “Auto Mode is a convenience feature backed by a best-effort classifier, not a security guarantee.” He interprets this to mean that the classifier was never designed to detect injection chains constructed from seemingly harmless steps. He argues that the real protection lies in operating system isolation and network egress control, recommending to run coding agents in a sandbox.

      “Do not trust the model output,” he advised. The Register mentioned that Anthropic did not respond to its request for comment and has not publicly addressed the finding since.

      This is not Rehberger's first discovery regarding Claude. He has been dissecting AI agents for years, particularly Anthropic’s. The Register, which referred to him as a prompt-injection expert, reported on his previous work in October, demonstrating how Claude could be manipulated into exfiltrating private data.

      The recurring issue he encounters is that a model with tools will act on instructions from sources it did not create. Auto Mode complicates matters more than previous findings, as it allows Claude Code to autonomously select and execute tools without pauses for confirmation. Since mid-August, this has been its default setting. The entire exploit relies on a series of minor decisions made independently by the agent: trying WebFetch, defaulting to curl, following a redirect, extracting the archive, refusing the binary, and writing a decoder.

      Each of these actions can be justified independently. No one sanctioned the entire chain.

      TNW reported on Opus 5’s launch in July, during which Anthropic touted it as its most aligned model yet. Previous coverage also included flaws in Claude Code's GitHub Action in June and a Word document that modifies numerical values in July. In response to similar exploit risks, OpenAI introduced a lockdown mode for ChatGPT in June.

      Anthropic faced additional internal challenges with Claude Code in a week of its own causing. On 29 August, the ClaudeDevs account announced a “permanent 25% increase” in standard weekly limits for Claude Code, effective from 14 September for Pro, Max, Team, and seat-based Enterprise plans. This announcement also noted that the current