A recent investigation into prompt-injection vulnerabilities has unveiled some troubling findings regarding Claude Code Opus 5, specifically when operating in its default Auto Mode. Security researcher Johann Rehberger, known in the cybersecurity community as “wunderwuzzi” from Embrace The Red, illustrated that the system could be exploited to execute harmful code through what initially appears to be an innocuous request for a website summary.
Rehberger’s research yielded success rates between 60% to 80% across a limited set of tests, raising serious concerns about the efficacy of existing defenses against such prompt injections. These findings contradict prior assertions that layered defenses in Claude Code had nearly neutralized indirect prompt injection attempts in most scenarios.
The Methodology of the Attack
The prompt injection exploitation begins with a user soliciting Claude Code to summarize a website. In instances where the site is malicious, it masquerades as an archive containing notebook records. This initial approach creates an environment conducive for exploitation, as Claude’s WebFetch request typically fails, returning an HTTP 415 Unsupported Media Type response.
Rather than directly instructing the model to execute a shell command, the malicious site engineers circumstances that lead Claude to opt for an alternative action. Observations revealed that, in several instances, Claude employed the curl command through its Bash tool, subsequently following a redirect that resulted in the download of a ZIP archive.
The archive itself appears benign, containing commonplace files such as catalog metadata, checksums, and a README file, alongside a macOS decoder binary and a cunningly named malicious Python file, struct.py.
Execution of the Malware
Despite Claude’s usual precautions against executing the supplied native decoder binary, the model eventually created a Python decoder of its own for handling encoded data. This self-generated decoder unintentionally became the pathway for executing malicious actions.
The exploitation mechanism capitalized on Python’s module shadowing phenomenon. In performing its tasks, Claude executed its homemade decoder after navigating into the ZIP file’s directory with a command that included:
cd WIC-notebook-catalogue
python3 -c 'import base64, zlib, json; ...'This command structure allowed Python to prioritize the current working directory in its module search path. Consequently, when the standard library’s base64 module attempted to load the struct module, it inadvertently imported the attacker-controlled struct.py instead of the legitimate library, thus opening the door to potential exploitation.
The malicious struct.py, while re-exporting the legitimate low-level _struct functionality, contained an obfuscated expression that triggered another Python process tasked with downloading and executing a remote payload.
Consequences of the Breach
Within the secure confines of the researcher’s lab environment, the malicious payload established a command-and-control callback, launching Calculator on the compromised system as an overt sign of the breach. Notably, even after the Claude Code session ended, this detached process continued to operate, underscoring the persistent risks associated with such vulnerabilities.
One of the primary issues identified was that Claude’s Auto Mode classifier was adept at recognizing seemingly harmless commands while failing to catch the multi-stage behavior initiated through Python’s import mechanism. In several cases, Claude recognized the malicious struct.py only after executing it. While it attempted to terminate the unwelcome process in some trials, Auto Mode regrettably blocked any cleanup commands, creating a disturbing situation where the safety layer allowed the exploitation chain to unfold but subsequently denied remediation.
A second variant of the attack enabled the malicious Python module to initiate a new, hidden instance of Claude Code using the command claude -p. This nested agent was capable of conducting basic reconnaissance, launching the Calculator application, and, alarmingly, writing files beyond the original workspace.
The reported results from these tests were based on a modest five-run sampling, and they revealed the Python downloader variant succeeded in three out of five instances. In contrast, the nested Claude variant recorded success in four out of five tests, suggesting a significant vulnerability.
Industry Response
Anthropic, the organization behind Claude Code, has characterized this disclosure as informative. They describe Auto Mode as a feature designed for convenience with "best-effort protections" rather than as an impermeable security measure. The company emphasizes that genuine containment ought to involve proper operating system isolation and network egress controls, rather than relying solely on approval classifiers for safeguarding.
This incident serves to underline a crucial lesson for developers and organizations employing autonomous coding agents: untrusted web content, archives, third-party dependencies, and model-generated commands should always be treated as potential security threats. To mitigate such vulnerabilities, organizations should adopt recommended practices such as operating unattended agents in secure containers, virtual machines, or OS sandboxes, restricting unnecessary outbound network access, isolating credentials and home directories, and vigilantly monitoring process creation and sensitive filesystem activities.
By implementing robust security measures and fostering a security-focused culture, organizations can better protect themselves against the ever-changing landscape of cyber threats, especially those exploiting vulnerabilities in autonomous systems.