A security researcher has published a working exploit that gets Claude Code to download and execute malicious code while running in Auto Mode, the feature Anthropic rolled out this month specifically to cut down on prompt-injection risk. The finding lands weeks after Anthropic pointed to independent testing showing a 0% attack success rate for the same feature, and it raises pointed questions about how much protection an AI classifier can actually offer once an attacker controls the content the agent is reading.
Johann Rehberger, a researcher who publishes under the handle “wunderwuzzi” on his blog Embrace The Red, says the attack chain succeeds between 60% and 80% of the time across his test runs. The entry point is almost mundane: a user simply asks Claude to summarize a webpage. From there, a chain of redirects, a booby-trapped ZIP archive, and a Python quirk called module shadowing do the rest, ending with a live command-and-control callback and, in his lab demonstration, the Calculator app popping open as visible proof of code execution.
Rehberger reported the issue to Anthropic, which closed the submission as “Informative,” a classification typically used for reports that don’t meet the bar for a paid bug bounty. Anthropic has not withdrawn its earlier safety claims about Auto Mode, but the episode is a reminder that a low measured attack rate in one controlled evaluation does not mean a feature is immune to determined, creative red-teaming from outside the company.
What Auto Mode was supposed to fix #
Auto Mode replaced the older “–dangerously-skip-permissions” flag as Claude Code’s way of running longer, multi-step tasks without stopping for approval on every single action. Instead of a blanket bypass, Anthropic built a classifier that lets Claude proceed unless an action looks irreversible, destructive, or aimed at something outside the user’s own environment. The company made Auto Mode the default for Pro, Max, and Team subscribers in mid-August, arguing that constant permission prompts were training users to click “approve” out of habit rather than genuine review.
The numbers Anthropic used to justify the switch
Anthropic backed the rollout with two studies. In a controlled test involving 1,053 paid participants, Auto Mode’s classifier caught 89% of harmful actions on its own, while human reviewers manually approving each step caught only 13.6%. Separately, the third-party firm Trajectory Labs ran 72 distinct indirect prompt-injection scenarios, each repeated 10 times, for 720 total attempts against Claude in Auto Mode. None succeeded, a result Anthropic contrasted with a 5.83% success rate it measured against a competing coding agent over the same test set.
| Metric | Result |
|---|---|
| Harmful actions caught by Auto Mode classifier | 89% |
| Harmful actions caught by manual human review | 13.6% |
| Permission prompts users approve without objection | 97% |
| Trajectory Labs prompt-injection attempts (Claude, Auto Mode) | 0 of 720 succeeded |
| Same test set, competing coding agent | 5.83% success rate |
Those figures are the backdrop against which Rehberger’s 60% to 80% success rate looks so jarring. His tests were not a formal benchmark and covered a small number of runs, but they targeted a specific technique that the Trajectory Labs scenarios apparently didn’t include.
How the exploit actually works #
Step one: a webpage that isn’t what it claims to be
Rehberger built a website styled as an archive of notebook records, complete with believable metadata, dates, checksums, and short entries meant to make it look like a legitimate data source. When a user asks Claude to summarize the page, Claude’s own WebFetch tool tries to load it and gets back an HTTP 415 “Unsupported Media Type” error. Rather than giving up, Claude typically decides on its own to retry the request using curl through its Bash tool.
Step two: a redirect toward the payload
The server responds to the curl request with an HTTP 303 “See Other” redirect, pointing to a ZIP archive. Rehberger describes this as one of the more reliable hijacking techniques available to an attacker: the malicious site never tells Claude what to do, it just makes the compromised path look like the obvious way to finish the task it was already given.
Why Claude falls for it
Nothing in this sequence looks overtly dangerous at any single step. Fetching a webpage, retrying with curl after an error, and following a redirect are all things a careful human developer might do without a second thought. That is exactly the property Auto Mode’s classifier is designed to catch, and exactly what the exploit is built to avoid triggering.
Step three: module shadowing does the damage
Inside the ZIP archive sits a batch of encoded files, a native decoder binary, and a plain-looking file named struct.py. Claude generally refuses to run the untrusted decoder binary, correctly flagging it as suspicious. Instead, it writes its own short Python script to decode the files, since the encoding format looks simple enough to handle directly. That script runs from inside the extracted archive folder and imports Python’s standard base64 module, which in turn needs to import a lower-level module called struct.
Because Python checks the current working directory for modules before checking its own standard library, it loads the attacker’s struct.py instead of the real one. That file quietly re-exports the legitimate low-level functions so decoding still appears to work normally, while also launching a separate, isolated Python process in the background. In Rehberger’s lab setup, that background process opened a command-and-control connection and popped open the Calculator app as a visible signal that arbitrary code had executed, all without Claude ever being told to run anything overtly malicious.
A safety feature that sometimes blocks the cleanup, not the attack #
Rehberger’s writeup includes a detail that undercuts confidence in Auto Mode’s real-time protections: in some runs, once Claude recognized that struct.py had been compromised and tried to kill the malicious process, Auto Mode blocked the termination command itself. The classifier had allowed the malware process to start but then treated stopping it as the riskier action, potentially giving an attacker more time inside the system.
Claude’s behavior wasn’t uniform across runs, which is part of what makes the results hard to reduce to a single percentage. In some tests, Claude correctly identified the archive as suspicious before triggering the exploit, ran its replacement decoder using Python’s isolated mode flag to avoid local files, or executed the script from a safe parent directory instead of the compromised one. Those safer paths appear to be part of why Rehberger’s reported success rate tops out at 80% rather than approaching 100%.
Not an isolated finding
This isn’t the only recent report describing agentic coding tools being tricked into running attacker-controlled code through a trusted-seeming local file. A separate set of tests published in July found that a similar exploit involving a modified Python library worked without changes across Claude Sonnet 4.6, Claude Sonnet 5, Claude Opus 4.8, and GPT-5.5, leading those researchers to describe it as a structural weakness of how current coding agents resolve local dependencies rather than a bug specific to one vendor or model.
What Anthropic and users should take from this #
Rehberger’s core message is blunt: Auto Mode approval should never be read as confirmation that code is actually safe. He recommends running coding agents inside isolated, disposable environments and monitoring what they do, treating Auto Mode as one layer of defense rather than a replacement for sandboxing. Anthropic’s own Auto Mode documentation describes a similar layered approach, screening content for injection attempts before it enters Claude’s context and running a separate classifier to review actions before execution, but Rehberger’s results suggest that combination can still miss an attack that unfolds gradually across several individually unremarkable steps.
For developers running Claude Code on real codebases, the practical takeaway is less about Auto Mode specifically and more about hygiene: avoid summarizing or processing content from unfamiliar or untrusted websites in an agentic session with broad filesystem or network access, and treat any archive downloaded mid-task as untrusted until a human has looked at it.