A new security demonstration by Johann Rehberger shows that Claude Code—the AI coding agent from Anthropic—can be manipulated to run malicious code on a user's machine by leveraging its default Auto Mode. The attack exploits a chain of seemingly harmless actions that lead the AI to execute dangerous commands without user approval.
- Claude Code Auto Mode can be hijacked with crafted web content
- Malicious code executes by exploiting Python module shadowing
- Anthropic urges sandboxing as Auto Mode has no security guarantees
What happened
Johann Rehberger, a security researcher specialized in AI prompt injections, found that Claude Code could be tricked into running attacker-supplied code about 60-80% of the time. He hosted a malicious website designed to trigger a sequence of fallback behaviors in Claude Code when asked to summarize the page. This began with failing WebFetch, leading the AI to use curl, then follow a redirect to download a ZIP archive filled with deceptive files.
Although Claude refused to run the included binary decoder, it proceeded to write a custom Python decoder using the base64 module. The attack used a shadowing technique by including a malicious struct.py file in the same directory, which was loaded instead of Python’s standard library module. This allowed the execution of arbitrary commands, such as launching Calculator or spawning new headless Claude sessions with full tool access.
Why it matters
This finding highlights inherent risks in AI agents that autonomously decide how to access and run external tools or code. Auto Mode, enabled by default since mid-August, removes user prompts and lets Claude Code independently select and execute tool calls. While designed as a convenience, it also expands the attack surface, making subtle multi-step prompt injections that seem safe individually capable of chaining into full code execution.
Anthropic has responded by emphasizing that Auto Mode relies on best-effort content classification rather than absolute security guarantees. The critical defense against these attacks is isolating AI agents from critical operating system functions and controlling network egress through sandboxing and strict environment controls. This research underscores that trusting AI output without safeguards can lead to serious security compromises.
What to watch next
Security professionals and AI developers should monitor how Anthropic and other AI providers address the balance between automation convenience and robust security. Enhancements in AI safety classifiers alone may not suffice to block complex multi-step injections that are individually innocuous. Expect increased focus on operational practices like sandboxing AI tools to prevent host-level compromise.
Further research will likely explore the prevalence of such prompt injection techniques across different AI agent frameworks and the evolving security models needed to contain them. Enterprises deploying coding assistants like Claude Code should proceed cautiously, vet tool access, and isolate AI execution environments to mitigate emerging threats from autonomous AI behaviors.