Ask Claude Code to summarise a web page, and it can end up running an attacker’s code on your machine. A security researcher got that result in up to 80% of his attempts.
Jessica Lyons reported the finding for The Register on Friday. The work is by Johann Rehberger, who publishes as wunderwuzzi and has spent years pulling apart AI agents. He set the chain out on his own blog, with a video. It targets Opus 5 running in Auto Mode. Auto Mode has been the default since mid-August.
The chain starts with a website dressed up as an archive of notebook records. Everything after that, the agent does to itself.
The safety guardrail is the exploit
Claude tries to read the page with WebFetch. The server answers 415 Unsupported Media Type, so the agent reaches for a Bash call with curl instead. Rehberger never tells it to do that. He just makes the tool it prefers fail.
The site then returns a 303 redirect to a ZIP archive, which Claude downloads. Inside are catalog metadata, a README, seven encoded notebook records, a macOS decoder binary, and a Python file called struct.py.
Claude refuses to run the decoder binary, exactly as its safety training says it should. Rehberger was counting on that. “This is planned and what the attacker wants,” he wrote. Blocked from the supplied decoder, the model writes its own.
“Ironically, that safety decision is the exploit path,” he wrote.
The decoder Claude writes imports base64. The standard base64 module imports struct. Python looks in the local directory first, finds the attacker’s struct.py sitting there, and loads that instead of the real one. Programmers call this module shadowing. It predates all of this by decades.
Rehberger used ChatGPT to obfuscate the malicious file enough to slip past Claude’s safety checks. The file then launched a separate Python process, pulled down a remote payload and called home to a command-and-control server. The payload opened Calculator, which is the polite way researchers demonstrate arbitrary code execution.
It can also start a second Claude
In another version, struct.py launches a fresh headless Claude Code session with claude -p. The injection stops being remote code execution and becomes a new agent.
“The nested Claude gets its own tool access and context,” Rehberger wrote. In his runs the child agent ran whoami, uname and id, opened Calculator, and wrote files into the home folder.
He tested three variants five times each and got success rates between 60% and 80%. He is careful about what that means. “I would say that these results are representative for a motivated attack, but not comprehensive,” he wrote.
Anthropic says it is working as designed
Rehberger reported the chain to Anthropic. The company told him the behaviour is working as designed. He paraphrased the rest of the response: “Auto Mode is a convenience feature backed by a best-effort classifier, not a security guarantee.”
His reading: the classifier never had to catch injection chains assembled from steps that each look harmless. The real boundary is operating system isolation and network egress control, he argues. Run coding agents in a sandbox.
“Do not trust the model output,” he wrote.
The Register said Anthropic did not respond to its own request for comment. Anthropic has not addressed the finding publicly since.
Not his first Claude finding
Rehberger has been taking apart AI agents for years, and Anthropic’s in particular. The Register, which calls him a prompt-injection wizard, covered his work last October showing Claude could be talked into exfiltrating private data.
The pattern he keeps landing on is the same one here. A model with tools, given something to read that it did not write, will follow what it reads.
Auto Mode is what makes this land harder than earlier findings. It is the setting that lets Claude Code decide for itself which tools to reach for and run them without stopping to ask, and it has been the default since mid-August. The whole exploit is a sequence of small decisions the agent makes on its own: try WebFetch, fall back to curl, follow the redirect, unpack the archive, decline the binary, write a decoder.
Each of those is defensible. Nobody approved the chain.
TNW covered Opus 5 when it launched in July, when Anthropic called it the most aligned model it had ever shipped. We also covered a flaw in Claude Code’s GitHub Action in June, and the Word document that rewrites your numbers in July. OpenAI added a lockdown mode to ChatGPT against the same class of attack in June.
The limits went up by going down
Anthropic had a second awkward week on Claude Code, this one of its own making.
On 29 August the ClaudeDevs account said the company was “permanently raising standard weekly limits in Claude Code by 25%” from 14 September, for Pro, Max, Team and seat-based Enterprise plans, and that the current 50% increase would run until then.
Both numbers sit in that one sentence. Take a limit currently running 50% above its baseline and reset it to 25% above, and it drops by about 17%. Anthropic said so itself in a reply: “Compared to today, this works out to a 17% reduction in weekly limits on Claude Code.”
The first post has 6.7 million views. The reply has 1.1 million. X readers attached a Community Note to the first one, pointing out the cut.
BleepingComputer, Notebookcheck and The Mac Observer all led on the reduction rather than the rise. Anthropic said it is working on changes that will give users more visibility and control over their usage.
Usage limits already put Anthropic in court. TNW reported in June on a lawsuit alleging it oversold the usage available on its $200 Claude Max plans.
Get the TNW newsletter
Get the most important tech news in your inbox each week.
