Claude Code auto mode: 'summarize this site' ran code

Johann Rehberger published an attack chain today that turns one boring instruction — summarize this website — into remote code execution inside Claude Code auto mode. It worked 60 to 80 percent of the time. Nothing in the chain is exotic. That is the part worth your attention.

What actually happened

Rehberger, who writes at Embrace The Red, walked Claude Code running Opus 5 through five steps, none of which asked it to do anything obviously bad.

The malicious site returns HTTP 415 to Claude's WebFetch tool. Claude falls back to Bash and curl on its own — it was never told to. The site then 303-redirects to a ZIP archive holding Base85/zlib-encoded files and a file named struct.py. Claude refuses to execute the supplied decoder binary, which is the safety layer working. So it writes its own decoder in Python, importing base64. Python resolves imports from the working directory first, so the attacker's struct.py shadows the standard library module and executes. Payload downloaded, C2 callback established.

Success rates were small-sample but consistent: 3 of 5 for the C2 variant, 4 of 5 for the subprocess-with-file-writes variant. The Register reports Anthropic's position: auto mode is a convenience feature backed by a best-effort classifier, not a security guarantee. Anthropic's own commissioned evaluation showed 0.00% attack success across 72 scenarios. This chain was not one of the 72.

Why prompt injection matters for your business

A 0.00% benchmark is a statement about the benchmark. Fixed-scenario evals measure the attacks someone already imagined. Rehberger's chain routed around every individual refusal by making each step look reasonable in isolation. Treat published injection resistance numbers as a floor, never a ceiling.

Your agent's tool fallbacks are the attack surface. The pivot from WebFetch to curl came from a status code, not a prompt. Any agent that can retry with a different tool can be steered by whatever it is reading. If your agent has Bash, it has everything Bash has.

Approval fatigue is the real vulnerability. Auto mode exists because nobody wants to click approve 300 times. Fine — but then the container is the control, not the click. Run unattended agents in a VM or OS sandbox, restrict network egress to an allowlist, and never let a coding agent hold production credentials.

Sources: Embrace The Red, The Register.