Researcher Breaks Claude Code Auto Mode With a Simple Page Summary Request

It took nothing more than asking the Claude Code coding agent to summarize a webpage to trigger remote code execution on the user's computer. Security researcher Johann Rehberger, known by the handle wunderwuzzi from the Embrace The Red blog, described on August 26, 2026 a complete attack chain against Auto Mode in Claude Code running on the Opus 5 model. Anthropic, after the report came in through its bug bounty program, closed the case with an "informational" status, declining to treat it as a vulnerability requiring a fix.

How the attack worked

The scenario began innocently. The user asks Claude Code to summarize a webpage. The rigged page returns an HTTP 415 error, an unsupported media type, which the WebFetch tool cannot handle. The agent decides on its own, without an explicit instruction from the user, to try fetching the content using curl. That switches the entire operation from the safe summarization mode to raw file downloading.

The trap in struct.py

The server redirects curl to a ZIP archive with a name suggesting a notes folder, containing seemingly legitimate files. Hidden inside, however, is a rigged struct.py file that impersonates the standard Python library module of the same name. Claude refuses to run the included binary file as unsafe, but writes its own decoding script in Python. That was the mistake that decided the outcome of the attack.

Claude doesn't trust the binary file it was given, but it trusts the one it wrote itself - Johann Rehberger, security researcher, Embrace The Red

The script written by the agent imports the base64 module, which in turn internally references the struct module. Because Python checks the local directory first when importing, it loads the rigged version instead of the genuine system library. The malicious struct.py re-exports the real API functions so as not to disrupt the program's operation, but in the process runs obfuscated code that spawns a child process in an isolated Python mode. That process downloads and runs the actual payload, establishing a connection to the attacker's command-and-control server.

Anthropic's position

Rehberger first reported the issue through Anthropic's bug bounty program, receiving no response, and then through the company's security channel. Anthropic classified the case as informational, not as a vulnerability requiring a fix. The company's position is that Auto Mode is a convenience feature built on a best-effort classifier, not a security guarantee. In Anthropic's view, determined, multi-step attack chains combining seemingly harmless steps fall outside what the classifier is meant to catch, and the real security boundary should sit at the operating system level, through isolation and network traffic control.

Rehberger called this "the 0.00 percent marketing problem." Anthropic commissioned Trajectory Labs to test Auto Mode against 72 standing prompt injection scenarios, with ten repetitions each, and announced zero successful attacks. In his view, such a result describes only the tests someone actually ran, not the attacks nobody has tried yet.

The attack doesn't tell the model what to do. The attack simply makes the malicious path the one worth taking to achieve the goal - Johann Rehberger, security researcher, Embrace The Red

Success rate and study limitations

Among the tested attack variants, success rates ranged from 60 to 80 percent. The variant using a Python command-and-control chain and the variant using environment reconnaissance each achieved 3 successful attempts out of 5, while the variant involving file writes by Claude reached 4 out of 5. The researcher himself cautions that these are results from motivated, targeted test attacks, not a universal measure of the system's resilience against every possible scenario.

Also notable is the moment when Auto Mode worked against the intent of its own safeguard. When Claude realized something had gone wrong and tried to clean up after itself, Auto Mode's own approval system blocked the cleanup command, flagging it as potentially risky. The safety mechanism itself became part of the failure.

What this means for companies

For companies and developers using coding agents in autonomous modes, the practical takeaway is this: approval by a classifier like Auto Mode is not proof that a given command is safe, only information that nothing raised suspicion for that particular mechanism. Rehberger recommends running unsupervised agents in containers, virtual machines, or system sandboxes, restricting outbound network traffic, isolating home directories, SSH keys and cloud credentials, and continuously monitoring the agent's actions.

The case adds to a growing list of incidents showing that coding agents with broad permissions to execute commands and download files from the network are an attractive target for attacks that chain together multiple seemingly harmless steps. For teams deploying such tools in Poland, this means autonomous modes need to be treated like any other code executed without supervision, with full environment isolation, rather than as a feature that polices its own security.