Prompt Injection Attack Hijacks Claude Code Opus 5 Auto Mode to Execute Malicious Code

A recent demonstration of prompt-injection research has revealed that Claude Code Opus 5, when running in its default Auto Mode, can be manipulated to execute malicious code via a seemingly harmless website summary request.

Security researcher Johann Rehberger, who writes under the name “wunderwuzzi” at Embrace The Red, reported success rates of 60% to 80% across a small set of tests.

These findings challenge recent claims that layered defenses have reduced the success of indirect prompt injection against Claude Code in Auto Mode to nearly zero in evaluated scenarios.

Prompt Injection Hijacks Claude Code Opus 5

The attack begins when a user requests Claude Code to summarize a website. The malicious site pretends to be an archive containing notebook records, initially causing Claude’s WebFetch request to fail with an HTTP 415 Unsupported Media Type response.

Instead of directly instructing the model to run a shell command, the site creates conditions that lead Claude to choose an alternative path. In observed cases, Claude responded by using curl through its Bash tool, followed a redirect, and downloaded a ZIP archive.

The archive contained seemingly innocuous files, including catalog metadata, checksums, encoded records, a README file, a macOS decoder binary, and a malicious Python file named struct.py.

Although Claude typically refused to execute the provided native decoder binary, an understandable precaution, it then proceeded to create its own Python decoder for processing the Base85, zlib, and JSON-encoded records. This self-generated decoder became the actual execution path.

The exploitation technique relied on Python module shadowing. Claude executed its decoder after navigating into the extracted ZIP directory with a command similar to:

cd WIC-notebook-catalogue
python3 -c 'import base64, zlib, json; ...'

Python places the current working directory early in its module search path. As a result, when the standard library’s base64 module attempted to import struct, Python loaded the attacker-controlled struct.py from the extracted archive instead of the intended standard library module.

The malicious module re-exported Python’s legitimate low-level _struct functionality so that decoding would continue normally and yield valid-looking data.

However, upon importing, an obfuscated expression initiated another Python process that downloaded and executed a remote payload.

In the researcher’s lab environment, the payload established a controlled command-and-control callback and opened Calculator as a visible sign of compromise.

The detached process could continue operating even after the Claude Code session ended.

The primary issue is that Auto Mode’s classifier detected Claude’s seemingly innocuous decoder command rather than the multi-stage behavior initiated by Python’s import mechanism.

In some tests, Claude managed to identify the poisoned struct.py only after executing it. In several instances, it attempted to terminate the malicious process, but Auto Mode blocked the cleanup command.

This created a dangerous reversal: the safety layer permitted the initial chain but denied remediation after the compromise was recognized.

A second variant used the malicious Python module to launch another headless Claude Code instance via `claude -p`. This nested agent conducted basic host reconnaissance, opened Calculator, and in some tests, wrote files outside of the original workspace.

The reported results stem from five-run samples, not an extensive benchmark. The Python downloader-and-command-and-control variant succeeded in three out of five tests.

In comparison, a nested Claude variant that wrote files outside the workspace succeeded in four out of five tests.

Anthropic has reportedly classified the disclosure as informative, describing Auto Mode as a convenience feature with best-effort protections rather than a strict security boundary.

The company asserts that proper OS isolation and network egress controls, not an approval classifier, should provide the real containment layer.

This incident reinforces a fundamental principle for autonomous coding agents: treat untrusted web content, archives, dependencies, and model-generated commands as potential threats.

Organizations should operate unattended agents in containers, virtual machines, or OS sandboxes; block unnecessary outbound network access; isolate credentials and home directories; and monitor process creation and sensitive filesystem activities.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC