A request to summarize a website is all it takes to seize control of Anthropic’s Claude Code agent and run commands on a Mac, with attacks succeeding up to 80 percent of the time.
Researcher Johann Rehberger, who publishes as wunderwuzzi, documented the chain in a new write-up. It targets Opus 5 running in Auto Mode, the safety-classifier mode that replaced human approval prompts and became the default for Claude Code in mid-August. An evaluation Anthropic commissioned from a third party logged a 0.00 percent success rate for prompt injection against the same model.
The attack starts when the agent’s WebFetch tool receives a 415 error, which nudges the model to fall back to curl on its own. The malicious site then redirects to a ZIP archive holding catalog-style notebook records, a native decoder binary, and a poisoned struct.py file.
Instead of touching the offered binary, the agent builds its own decoder in Python, and that self-written step is exactly what the exploit chain weaponizes. That safety decision becomes the exploit path, because the decoder runs inside the extracted archive where struct.py shadows the Python standard-library module of the same name. When the decoder imports base64, which itself imports struct, the poisoned file executes.
The payload launches a remote process, opens Calculator as a proof of concept, or spins up a second headless Claude Code instance that performs reconnaissance and writes to local files. Rehberger reported success rates between 60 and 80 percent across three variants.
The company’s public position has long been that stacking defenses can contain indirect prompt injection. Rehberger’s take: Auto Mode is not a substitute for running the agent in an isolated environment and monitoring what it does.
