Ask Claude Code to summarize a website. That’s the entire setup. Security researcher Johann Rehberger published a multi-stage attack on August 26 that achieves remote code execution against Claude Code Opus 5 in Auto Mode with a 60 to 80 percent success rate — by exploiting a Python module shadowing technique so fundamental that no AI safety layer can intercept it. Anthropic classified the report as “informative” rather than a vulnerability. They also made Auto Mode the default for all Pro, Max, and Team accounts twelve days earlier.
How One HTTP Error Becomes Code Execution #
The attack does not start with a jailbreak. It starts with a website that returns an HTTP 415 “Unsupported Media Type” error when Claude’s WebFetch tool tries to access it. Claude autonomously decides to retry using curl
instead. The site then serves a ZIP archive containing what looks like notebook records — a README, CSV files, a SHA256 manifest — alongside encoded data files and a malicious struct.py
.
Here is where it gets technically interesting. Claude, acting cautiously, refuses to run the supplied binary decoder. Instead, it writes its own Python decoder from scratch. That decoder imports base64
. Python’s base64
module imports struct
as a dependency. Moreover, Python’s module resolution searches the current working directory before the system library paths.
The attacker’s struct.py
is already sitting in that directory. It runs at import time. There is no prompt — no instruction, no jailbreak — that a safety classifier could catch, because this happens entirely at the Python interpreter level. The malicious module spawns a child process, downloads a payload, and establishes a command-and-control callback. As a result, Rehberger’s test runs showed 60 to 80 percent success rates depending on the variant.
The Benchmark Gap That Matters #
When Anthropic’s Auto Mode shipped as the default on August 14, the company cited an evaluation by Trajectory Labs showing it blocked all 72 prompt injection attacks tested. Claude Code head Boris Cherny said he “couldn’t imagine going back to permission prompts.” That 0.00% attack success rate is real — within the scenarios tested.
However, Rehberger’s attack was not one of those 72 scenarios. Anthropic’s own response confirms this: “Determined prompt injection chains that combine benign-looking steps are not what the classifier is intended to stop.” In other words, the benchmark covers known attack patterns. Novel chains are out of scope. That distinction matters when Auto Mode is running unsandboxed on 39 percent of professional developers’ machines — the share who use Claude Code professionally, according to the JetBrains 2026 Developer Ecosystem Survey.
Auto Mode Blocked Its Own Cleanup #
The most damning detail in Rehberger’s report is not the initial compromise — it’s what happened after. In several test runs, Claude detected the malicious struct.py
following exploitation and attempted to remove it. Auto Mode blocked the cleanup command. Consequently, the safety system that let the attack in then prevented remediation.
Simon Willison, who tracks AI security closely, called this the most concerning element: “Auto Mode denied the cleanup command.” He endorsed Rehberger’s characterization of the attack as a “confused environment attack” — not classic prompt injection, but a systemic design issue where the agent’s operational environment is itself the vulnerability.
This Is Not an Outlier #
Furthermore, Claude Code is not uniquely broken. CVE-2026-54316 demonstrated an API key being exfiltrated from Claude Code one character at a time via Hugging Face’s download counter. CVE-2026-12537 (CVSS 10.0) showed a zero-privilege GitHub issue could compromise CI secrets via Gemini CLI. Check Point Research documented malicious .mcp.json
files auto-approving attacker-controlled MCP servers earlier this year. AI coding agents have expanded the attack surface for development environments substantially, and the security models have not kept pace.
What To Do #
In fact, Anthropic’s own response contains the correct answer, buried in the dismissal: “The real boundary is OS isolation and network egress control.” Sandboxing is not optional for unattended agent workloads.
Containerize or virtualize: Run Claude Code in a Docker container, Firecracker microVM, or gVisor-isolated environment for any unattended or CI/CD workload. Tools like E2B and Modal offer pre-built sandboxes with sub-second startup.Restrict network egress: Most coding tasks do not require outbound internet access. An egress firewall removes the C2 callback step entirely.** Isolate credentials**: SSH keys, AWS credentials, and API tokens should never live in a directory the agent can reach.** Disable Auto Mode in pipelines**: CI/CD automation is exactly where unsupervised agents face adversarial content. Use explicit permission prompts for automated workflows.
Auto Mode approval does not mean a command is safe. It means the classifier did not flag it in the scenarios it was trained on. Those are different things, and this research makes that gap concrete.