Researcher chains prompt injection into code execution in Claude Code's Auto Mode

Independent security researcher Johann Rehberger, who publishes as “wunderwuzzi” and has previously disclosed prompt-injection flaws in other AI agent products, described a chain of exploits that turned an ordinary request to summarise a webpage into arbitrary code execution inside Claude Code running in Auto Mode, the permission setting Anthropic had made the default twelve days earlier.

The attack began with a malicious webpage that returned an error when Claude Code tried to fetch it, prompting the model to retry with a command-line tool and download a ZIP archive. Inside the archive, alongside decoy files, sat a Python module named struct.py — a name that shadows a standard-library module. When Claude wrote its own script to decode the archive’s contents and ran it from that directory, Python loaded the attacker’s file instead of the real library, which then downloaded and executed a remote payload with a command-and-control callback. Rehberger reported success rates of 60 to 80% across small batches of repeated attempts against Claude Opus 5 running in Auto Mode.

Anthropic’s response, as described in the post, was to close the report as “informative” rather than treat it as a vulnerability needing a fix. It characterised Auto Mode’s screening classifier as “a convenience feature backed by a best-effort classifier, not a security guarantee,” and said the real defence against this class of attack is operating-system isolation and network egress control rather than the model’s own judgement — a position consistent with how Anthropic has described Claude’s containment architecture elsewhere. Auto Mode remained the default after the disclosure, and the episode added to a run of 2026 research finding new attack surfaces in agents that act on tools and computers directly rather than only answering questions in a chat window.