Claude Code auto mode runs attacker code via module shadowing
Asked to summarise a researcher's web page, Claude Code in auto mode switched to curl, pulled a ZIP archive, wrote and ran its own Python decoder inside the extracted folder, and loaded a planted struct.py that ran the attacker's code.
Johann Rehberger (Embrace The Red) published on 26 August 2026 an attack chain against Claude Code running Opus 5 in auto mode. A web page returned HTTP 415 to WebFetch, so Claude decided to fetch it with curl in bash. The server redirected to a ZIP of encoded notebook records plus a decoder binary and a malicious struct.py. Claude refused to run the supplied binary but wrote its own Python decoder and ran it from the extracted directory; importing base64 pulled in struct, which Python resolved to the attacker's file. The payload started an isolated Python subprocess that fetched a remote stage, set up C2 callbacks and opened Calculator; another variant launched a second headless Claude Code. In some runs Claude noticed the compromise and tried to clean up, and auto mode denied the cleanup command. Reported success was 60 to 80 percent across small samples of five runs per variant. Anthropic closed the report as Informative, saying auto mode is a best-effort classifier, not a security guarantee, and that the boundary is OS isolation and egress control. The work came three weeks after Anthropic published a vendor evaluation with no successful attacks in 720 attempts against auto mode, and twelve days after auto mode became the default on 14 August 2026.
- Unknown
- Not disclosed
- Someone else
- An outside report
What happened
Researcher runs the chain against Claude Code with Opus 5 in auto mode
Asked to summarise a site; after an HTTP 415 on WebFetch, Claude switched to curl, followed a 303 redirect to a ZIP, wrote its own decoder and ran it in the extracted folder, loading the planted struct.py. Three variants, five runs each, 60 to 80 percent success. Not dated.
Payload fetches a remote stage, sets up C2, or spawns a headless Claude Code
Variants: python3 -I stager with native payload and C2; a nested claude -p running recon; file writes outside the workspace. In some runs auto mode denied Claude's own cleanup command.
Report sent to modelbugbounty@anthropic.com, no response
Report resubmitted through Anthropic's security reporting channel
Rehberger says he heard back quickly.
Anthropic closes the report as Informative, working as designed
Auto mode described as a convenience feature backed by a best-effort classifier; the boundary is OS isolation and egress control.
Embrace The Red publishes "Breaking Claude Code Opus 5 Auto Mode"
Simon Willison writes it up
The Register reports; Anthropic does not reply to its comment request
GovInfoSecurity reports the attack and Anthropic's guidance
Tech Times reports no fix is planned
Agent failures
Prompt injection / context poisoning, Untrusted code execution
Prompt injection / context poisoning
Untrusted code execution
How it was found
Found first by someone else, from an outside report
- Someone else
- An outside report
- Not disclosed
This is deliberate vulnerability research, not an agent acting unprompted in the wild. The researcher built the malicious site and archive and observed the resulting actions (curl download, extraction, decoder run, payload execution) on his own machine. No victim or in-the-wild exploitation is reported.
What is publicly known
5 of 12 fully public
| Item | Public? | Detail | Sources |
|---|---|---|---|
| Partial | Claude Code running Opus 5; no model id or Claude Code version given. | ||
| Unknown | The post does not mention thinking or effort settings. | ||
| Known | Auto mode, the default since 14 August 2026, a classifier approving commands; no other permission setting described. | ||
| Unknown | No system prompt or custom configuration disclosed. | ||
| Known | The prompt is given: summarise a named archive site, domain partly redacted. | ||
| Partial | Claude Code with WebFetch and Bash, using curl and Python. Claude Code version not stated. | ||
| Weak | Test endpoint served content only to allow-listed IPs; the test machine's egress setup is not described. | ||
| Partial | Screenshots and an end-to-end video; no full session log. | ||
| Known | Researcher observed effects directly: Calculator launched, C2 callback, nested Claude Code. Success rates per variant given. | ||
| Partial | Researcher's own machine only; no in-the-wild victims reported. Exposure to other auto mode users not measured. | ||
| Known | Classifier sees only the short decoder, not the multi-hop chain; module shadowing via a planted struct.py. | ||
| Known | Anthropic closed the report as Informative, working as designed; no fix planned. |
Controls that apply
Govern
Protect
Detect
- All controls →
Coverage and commentary
3 statements, 4 articles
What the parties involved said
Johann Rehberger
Auto mode approval is not evidence a command is safe; run agents in containers, VMs or OS sandboxes, restrict egress, keep credentials out of reach and monitor agent activity. Contrasts his result with the 0.00% figure Boris Cherny shared.
Anthropic (as quoted by Rehberger)
Closed the report as Informative and working as designed: auto mode is a convenience feature on a best-effort classifier, determined chains of benign-looking steps are not what it aims to stop, and the real boundary is OS isolation and egress control.
Anthropic
When making auto mode the default, stated that it relies on classifiers and does not eliminate risk, and recommended manual review for high-stakes production changes.