Anthropic's Claude Code running Opus 5 in Auto Mode can be hijacked into executing attacker-controlled code simply by being asked to summarize a website, according to a new security demonstration published by prompt-injection researcher Johann Rehberger, also known as wunderwuzzi. The attack succeeds up to 80 percent of the time, Rehberger reported. The demonstration focuses on Opus 5 in Auto Mode, which became Claude's default configuration in mid-August.

The attack begins by directing the AI coding agent to summarize a malicious website disguised as an archive of notebook records. The technique tricks Claude into using curl rather than its WebFetch tool to fetch the page contents, without explicitly instructing the model to do so. When the WebFetch request fails with a 415 Unsupported Media Type error, the model chooses to access the site directly through a Bash tool call using curl. The website returns a 303 redirect to a malicious ZIP archive, which Claude downloads. Inside the archive sits a poisoned Python file called struct.py alongside apparently innocent files including catalog metadata, a README, seven Base85/zlib-encoded JSON notebook records, and a macOS decoder binary. Claude's safety guardrails prevent it from running the supplied decoder, but the AI opts to write its own decoder instead. This decoder imports base64, and the attack exploits Python module shadowing—when a local file shares a name with a Python standard-library module, hiding the official version and causing Python to load the impostor. Because the standard-library base64 module imports the legitimate struct module, and the malicious archive contains a file with that same name, the poisoned code executes. Rehberger tested three attack variants five times each, noting these were small samples, and reported success rates ranging from 60 percent to 80 percent.

"Ironically, that safety decision is the exploit path," Rehberger wrote about Claude's refusal to run the supplied binary. The researcher used ChatGPT to obfuscate the malicious struct.py code to evade Claude's safety controls, successfully launching a separate Python process that downloads and executes a remote payload—in his demonstration, a command-and-control callback that opened Calculator. In another attack scenario, struct.py spawned a second, headless Claude Code instance via claude -p, meaning this prompt injection can create an entirely new agent. "The nested Claude gets its own tool access and context," Rehberger noted, adding that in his tests the child agent performed basic reconnaissance commands, opened Calculator, and wrote to local files in the home folder. Anthropic reportedly told Rehberger that the model's "behavior is working as designed," and that Auto Mode is "a convenience feature backed by a best-effort classifier, not a security guarantee." According to Rehberger's paraphrase of Anthropic's response, the classifier isn't designed to stop determined prompt-injection chains composed of individually benign-looking steps, with the real security boundary being OS isolation and network egress control.

The central takeaway, according to Rehberger, is to operate this and other coding agents inside a sandbox. "The solution is something we talked about for many years," he wrote. "Do not trust the model output." The demonstration underscores that even safety-conscious AI models can be manipulated through multi-step attack sequences that appear harmless in isolation, with each innocent-seeming action chaining into exploitation. The real-world implication is that organizations deploying agentic coding tools must assume model outputs can be compromised and architect their defenses accordingly, treating the AI agent itself as an untrusted component rather than a secure collaborator. As AI agents gain broader tool access and autonomy, the gap between designed safety features and actual security guarantees will likely widen unless isolation becomes the default deployment posture rather than an optional precaution.