New exploit tricks Claude Code into running malicious code despite Auto Mode

Anthropic recently introduced Auto Mode, which lets Claude Code roam without routine permission prompts, and touted a near-zero prompt-injection success rate. However, a security researcher has repeatedly tricked Claude into running malware.

Auto mode replaced the “--dangerously-skip-permissions” flag as a safer, classifier-based security feature that lets Claude Code run on longer tasks without constantly prompting for permissions.

Claude, in the default Auto Mode, proceeds unless an action looks “irreversible,” “destructive,” or aimed outside the environment.

But safer doesn’t mean it is safe.

Anthropic recently claimed that with auto mode enabled, “no attack in an independent evaluation was successful against any of our models.” The chart showed 0.00% “prompt injection attack success rate” in browser use and tool calling.

Security researcher Johann Rehberger, also known as “wunderwuzzi,” put the claims to the test and demonstrated an exploit where Claude Code reliably grants attackers remote code execution.

“If you care about what’s happening and are worried about misalignment, hallucinations, and prompt injection, then Auto Mode IS NOT a substitute for running your agent in an isolated environment and monitoring what it is up to,” the researcher warns in a report, disclosing how the Auto Mode was broken.

Simply asking Claude Code to summarize a website can lead to a complete compromise. The researcher claims that the success rate of the attack is up to 80%.

Claude is vulnerable to social engineering

The researcher created a website presenting itself as an archive of notebook records, storing them in a Zip archive. Wrapped with plausible metadata, dates, checksums, and 7 short records, the site appears legitimate to Claude.

When tasked with summarizing it, Claude typically attempts to use its own WebFetch tool to retrieve the page’s contents. However, the attacker’s site in this case returns an error: “415 Unsupported Media Type.”

Claude itself decides to fetch the page using curl, and the server responds with an HTTP 303 “See other” status code – a redirection response telling to load a different URL. In this case, the redirection leads to a malicious ZIP archive.

“This is one of the key hijacking techniques commonly used. An attack does not tell the model what to do. The attack just makes the malicious path the one worth pursuing to solve an objective,” the researcher explains.

When ZIP is downloaded, Claude typically extracts the contents to a temporary folder, but refuses to run a payload that might be malicious.

The ZIP archive in this contains fake files in “a special encoding” and offers a native decoder.

Claude correctly notices that the provided tool looks sketchy and, instead of using it, decides to write a small Python program to decode the files, since the file format appears simple enough.

But the actual malicious payload is not in the files, nor in the decoder, but in another file named “struct.py.” This exact name is used by Python’s own standard library – struct is a data type conversion tool.

When Python looks for the required libraries, it checks the current folder first.

Claude trusts its decoder, launches it from the same folder, and then Python loads the malicious library – at this point, the attack is complete. The researcher even included an actual command-and-control server callback in the malicious code to “prove that Claude does not inspect the code anymore before execution.”

“Auto Mode” blocks Claude from attempting a cleanup

The researcher observed “a lot of interesting outcomes” in how Claude handles the compromise while decoding fake records.

Once it recognizes the struct.py library as booby-trapped, it warns the user.

“Sometimes it said it hadn’t executed the malicious instructions (it did), and sometimes it said it did get compromised. Claude did not intentionally invoke struct.py,” the researcher’s blog post on embracethered.com reads.

When Claude tried to terminate the malicious process, the Auto Mode denied the cleanup command, potentially giving attackers more time.

“The classifier allowed the creation of the malware process, but then it blocked the command intended to stop it,” the researcher noted.

However, Claude sometimes correctly analyzed the provider archive statistically and never ran Python from its root. It used the -I flag to use isolated mode. Sometimes it correctly recognized the attack before triggering, or ran the replacement “decoder” from its safe parent directory.

The researcher disclosed the findings to Anthropic, which closed the report as “Informative.”

While Auto Mode reduces risks, it doesn’t eliminate the need for sandboxing AI agents – attackers are getting better at creating payloads.

“Do not treat an Auto Mode approval as evidence that code is safe,” the report concludes.