Researcher shows how Claude Code can be tricked simply by asking it to summarize a website

Anthropic’s Claude Code running Opus 5 in Auto Mode can be tricked into executing attacker-controlled code simply by asking the coding agent to summarize a website.

The attack works up to 80 percent of the time, according to prompt-injection wizard Johann Rehberger, aka wunderwuzzi.

In a blog and video demo, he detailed how to hijack Opus 5 in Auto Mode, which is the default setting for Claude as of mid-August.

It starts off by asking the agentic coding model to summarize a malicious website that presents itself as an archive of notebook records, and then tricking Claude into using curl instead of its WebFetch tool to retrieve the contents of the page – but without directly telling the model to use curl.

The WebFetch request fails, returning a 415 Unsupported Media Type response, so the model decides to access the website directly by issuing a Bash tool call with curl.

The website returns a 303 response, and redirects to a malicious ZIP archive, which Claude then downloads.

This archive contains seemingly harmless files including catalog metadata, a README file, seven Base85/zlib-encoded JSON notebook records, a macOS decoder-darwin binary – plus a poisoned Python file named struct.py.

Claude, per its safety guardrails, refuses to run the decoder: “This is planned and what the attacker wants,” Rehberger wrote.

Instead of using the supplied binary, the AI decides to write its own decoder.

“Ironically, that safety decision is the exploit path,” Rehberger explained, adding a purple devil emoji to the text.

The new decoder imports base64, and from here the attack relies on Python module shadowing to trick the model into running the malicious struct.py code.

Module shadowing occurs when a local file shares the same name as a Python standard-library module.

The local file hides the official module, causing Python to load it instead.

In this case, the standard-library base64 module imports the legitimate struct module, and the malicious ZIP contains a malicious file with the same name.