Security Researcher Demonstrates Remote Code Execution Exploit in Anthropic's Claude Code

A vulnerability in Anthropic's Claude Code coding assistant allows attackers to achieve remote code execution on a developer's local machine through indirect prompt injection, according to technical research published by cybersecurity investigator Johann Rehberger. Operating under the online handle wunderwuzzi, Rehberger released a technical blog post and video demonstration illustrating how Claude Code—specifically when running the Opus 5 model in Auto Mode, which became the default configuration in mid-August—can be tricked into executing arbitrary commands simply by being requested to summarize a web page.

The attack vector relies on asking the agentic coding tool to summarize a web page disguised as an archive of notebook records. When Claude Code attempts to parse the URL using its built-in WebFetch utility, the server generates an HTTP 415 Unsupported Media Type response. Rather than terminating the operation or seeking user intervention, the model independently decides to circumvent the tool failure by issuing an unprompted Bash tool call using the curl command line utility to retrieve the site's contents directly.

Upon executing the curl request, the target web server responds with an HTTP 303 redirect that steers Claude Code into downloading a compressed ZIP archive. The downloaded archive contains several seemingly benign components, including catalog metadata, a README documentation file, seven Base85 and zlib-encoded JSON notebook files, and a compiled macOS binary named decoder-darwin. In addition to these files, the archive conceals a malicious Python file named struct.py.

Anthropic's safety guardrails function as designed when Claude Code inspects the archive, prompting the AI assistant to refuse execution of the untrusted macOS binary file. However, Rehberger highlighted that this safety mechanism ironically forms the core exploit path. Fulfilling its objective to process the archive without using the blocked binary, Claude Code autonomously generates its own custom Python script to decode the enclosed data files.

The AI-generated script begins by importing Python's standard base64 library. Under standard Python operations, the base64 module automatically imports the standard library's struct module. However, because the archive placed the malicious struct.py file in the local working directory, Python loads the local file instead of the official system module—a technique known as Python module shadowing. Rehberger disclosed that he utilized OpenAI's ChatGPT to obfuscate the malicious struct.py code, enabling it to bypass Claude's content safety checks. Once loaded, struct.py spawns a separate Python process that fetches and executes a remote command-and-control callback, opening the macOS Calculator application as a proof of concept.

In a secondary attack scenario detailed by Rehberger, the malicious struct.py script spawns a headless child instance of Claude Code by calling the system command claude -p. This secondary agent gains its own distinct tool access privileges and isolated context window. In testing, the child agent executed system reconnaissance commands including whoami, uname, and id, wrote files to the user's home directory, and opened local applications without user oversight.

Across three experimental attack variations tested five times each, Rehberger observed exploit success rates ranging between 60 percent and 80 percent. Although the researcher acknowledged that these tests involved small sample sizes, he noted that the outcomes are representative of what a motivated attacker could achieve using multi-stage prompt injection techniques composed of individually innocuous commands.

Anthropic did not respond to requests for comment from The Register, which first reported the research, but reportedly informed Rehberger that the model's actions were "working as designed." Paraphrasing Anthropic's response, Rehberger noted that the company treats Auto Mode as a convenience feature supported by a best-effort classification system rather than an absolute security boundary. According to the research, Anthropic considers operating system isolation and network egress filtering to be the primary defensive boundaries for AI development tools. Rehberger concluded that organizations must deploy autonomous coding agents inside sandboxed environments and refrain from trusting raw model outputs.