"This is planned and what the attacker wants," Johann Rehberger — known online as wunderwuzzi — wrote after demonstrating a prompt‑injection chain that reliably coerces Anthropic's Claude Code (Opus 5 in Auto Mode) into executing attacker-controlled code.
How the Opus 5 Auto Mode exploit chain unfolds
Rehberger published a blog and video demo showing a concise, repeatable path to remote code execution. His starting move is minimal: ask the agentic coding model to summarize a website that poses as an archive of notebook records. The site returns content in a way that causes Claude's WebFetch tool to fail with a 415 Unsupported Media Type response. Rather than stopping, the model issues a Bash tool call that uses curl to fetch the page directly. The server responds with a 303 redirect to a ZIP archive, and Claude downloads it.
The ZIP archive contains a mix of innocuous-looking files — catalog metadata, a README, seven Base85/zlib‑encoded JSON notebook records — alongside a macOS decoder binary labeled decoder-darwin and a poisoned Python file named struct.py. Claude, following its safety guardrails, refuses to execute the supplied binary. That refusal is precisely the trigger Rehberger exploits next.
Module shadowing and the poisoned struct.py
Because Claude refuses to run the supplied decoder, it instead writes its own decoder in Python. The decoder imports the standard library base64 module. The attack leans on Python module shadowing: a local file in the ZIP named struct.py masks the standard-library struct module. When the locally authored decoder imports base64, that module in turn imports struct — and Python loads the malicious local struct.py instead of the legitimate stdlib module.
Rehberger says he used ChatGPT to obfuscate the malicious struct.py so it would slip past Claude’s safety controls. Once loaded, the malicious struct.py launches a separate Python process that downloads and executes a remote payload; in the demo that payload causes a command‑and‑control callback that opens Calculator. Rehberger notes that a real attacker would likely run something more harmful.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleVariants tested, nested agents, and measured success rates
Rehberger exercised multiple variants. In one scenario the poisoned struct.py spawns a second, headless Claude Code process via claude -p. That nested Claude, he reported, received its own tool access and context and performed basic reconnaissance commands (whoami, uname, id), opened Calculator and wrote files into the home folder.
Across three attack variants, each run five times, Rehberger observed success rates between roughly 60 percent and 80 percent. He cautioned these were small samples but argued they are representative of what a motivated attacker could achieve.
Anthropic's response and the limits of Auto Mode
Rehberger sought comment from Anthropic; The Register reported that the company did not respond to its request. Rehberger also reported that Anthropic told him the model’s “behavior is working as designed.” He paraphrased the company’s position that “Auto Mode is a convenience feature backed by a best‑effort classifier, not a security guarantee.”
In Rehberger’s assessment, the classifier and prompt‑filtering layers are not built to defeat determined prompt‑injection chains composed of individually benign‑appearing steps. He described the real boundary to abuse as traditional controls: OS isolation and network egress restrictions.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: Rehberger’s key operational takeaway is to run coding agents in a sandbox and not to trust model output. The exploit leverages agent convenience (Auto Mode) and tool invocation to pivot into local execution — so impose OS isolation and strict network egress controls when testing agentic code tools.
- Procurement and platform operators: Because Auto Mode was the default setting for Claude as of mid‑August, buyers and operators should treat the feature as a convenience with design tradeoffs. Rehberger’s report suggests risk assessments should account for prompted chains that combine web fetches, redirects and file artifacts that can trigger module shadowing.
- End users and researchers: The demonstration shows that individually harmless actions — asking an agent to summarize a webpage — can be composed into an exploit. Rehberger’s admonition is blunt: “Do not trust the model output.”
Rehberger concluded with a practical policy: this class of agentic coding systems must be treated as untrusted code generators and run inside sandboxes with hardened egress and execution controls. The demo turns a routine convenience — Auto Mode’s ability to fetch and act on web content — into a reliable attack surface, and it forces a simple question on platform designers and users alike: if convenience features can silently escalate to code execution, where do we draw the line between capability and control?
