A researcher got Claude Code's Auto Mode to run malware up to 80% of the time. Anthropic closed the report as 'Informative,' not a vulnerability

Security researcher Johann Rehberger published a report August 26 showing that a single request to summarize a booby-trapped website can chain, inside Claude Code's Auto Mode, into real code execution -- a downloaded payload, a command-and-control callback, and in one variant, a second Claude Code instance launched by the first. Across his own small-sample tests, Rehberger reported the chain succeeding 60% to 80% of the time, depending on the variant.

The attack doesn't tell Claude to do anything overtly malicious at any single step -- that's the point. In Rehberger's own framing: "An attack does not tell the model what to do. The attack just makes the malicious path the one worth pursuing to solve an objective." His test site returns an HTTP 415 error to nudge Claude off its normal web-fetch tool and onto curl, then serves a ZIP archive disguised as a folder of notebook records.

The exploit's cleverest step is the one that looks like good behavior. Rather than run the suspicious binary decoder included in the archive, Claude -- correctly, by its own safety training -- writes its own Python decoder instead. But running that decoder from inside the extracted archive's own directory means Python's import system picks up the attacker's local `struct.py` file ahead of the identically-named file in Python's standard library. The attacker never had to talk Claude into anything unsafe; they only had to plant a file with the right name in the right place and let ordinary Python import behavior do the rest.

Anthropic's security team reviewed Rehberger's report and closed it as Informative rather than a vulnerability requiring a fix. Rehberger, paraphrasing the response, says Anthropic told him Auto Mode is "a convenience feature backed by a best-effort classifier, not a security guarantee" -- and that the real security boundary sits in OS-level isolation and network egress control, not in the classifier that approves or blocks each step. Anthropic did not respond to The Register's request for comment on the report.

Independent developer Simon Willison, summarizing Rehberger's findings, flagged a further wrinkle: in some test runs, Claude detected that its own environment had been compromised and tried to kill the malicious process -- and Auto Mode's own approval gate blocked the cleanup command. "The safety mechanism itself can become part of the failure," Willison wrote. (Willison isn't affiliated with Anthropic or Rehberger -- he's an independent developer whose write-ups of agentic-coding security issues are widely read inside the field, which is why his framing of a finding often travels further than the original report.)

Rehberger also tested a variant where the malicious payload didn't just call out to a remote server -- it launched a second, nested Claude Code instance to carry out the rest of the attack. That nested instance gets its own tool access and its own context, separate from the session the user actually started, which means a single compromised summarization request can spawn an agent the user never knowingly invoked, running with whatever permissions the original session already had. Rehberger reported this variant succeeding in three to four of five runs, roughly the same range as the simpler command-and-control chain.

Anthropic has previously cited a third-party evaluation putting Claude Code Opus 5's Auto Mode at a 0.00% prompt injection success rate -- a figure that sits uneasily next to Rehberger's reported 60-80%. The gap looks less like a contradiction than a scope mismatch: the cited evaluation measured a fixed set of known prompt injection scenarios, while Rehberger built a chain of individually ordinary-looking steps that no single classifier check was designed to catch.

Sorting out which of these claims are actually established, rather than just repeated, is worth doing explicitly:

Six days after Rehberger's report, on September 1, Claude Code version 2.1.257 shipped with a new Containment Escape rule: cloud metadata-credential fetches, egress evasion, and cross-tenant reach are no longer auto-approved in Auto Mode unless a project's own configuration marks them expected. The same release made Claude Fable 5.1 the default model. Nothing in Anthropic's own changelog names Rehberger's report as the reason for the rule, and it targets a narrower, different class of behavior -- credential and network-boundary escapes -- than the ZIP/module-shadowing chain he demonstrated. Whether the two are connected is exactly the kind of claim that shouldn't be assumed just because the timing lines up.

None of this means Claude Code is uniquely unsafe among agentic coding tools, or that Auto Mode is broken for its intended use. It means Auto Mode's own maker has now said, on the record, that its classifier is a convenience layer rather than a security boundary -- which puts the actual security decision back where Anthropic says it belongs: on whatever sandbox, credential scope, and network egress rules a developer sets up around the agent, not on the tool's own judgment about what's safe to run.