Claude Code was hijacked by a request to summarize a website

A researcher asked Claude Code to summarize a web page, and the agent wrote its own decoder, imported the attacker’s module and ran a remote payload.

The chain

The chain was published on August 26, 2026 by security researcher Johann Rehberger on Embrace The Red, and covered by The Register on August 28. The target was Claude Code with Opus 5 in Auto Mode, the setting where a classifier decides which actions are safe enough to run without asking. The prompt was as plain as it gets: summarize this website.

Step one: the site answers with HTTP 415, so Claude’s built-in fetch fails and it reaches for curl in the shell. Step two: the download is a ZIP with encoded records and a ready-made decoder binary. Claude refuses to run the stranger’s binary, which looks like the safe choice. Step three: it writes its own Python decoder instead, and when that script imports a standard library, Python loads the attacker’s struct.py from the unpacked archive first. Step four: the shadowed module launches a hidden Python child that downloads and runs the final stage. Success rate across variants: three to four runs out of five, 60 to 80%.

Anthropic’s answer

Anthropic, per the write-up, closed the report as “Informative”: Auto Mode is “a convenience feature backed by a best-effort classifier, not a security guarantee.” Rehberger’s own conclusion agrees on the fix, if not the framing: “The real boundary is OS isolation and network egress control,” not the model’s judgment.

The uncomfortable part

The agent behaved well at every visible step. It declined the binary. It wrote clean code. It simply did all of it inside a directory the attacker had prepared. The lesson for anyone running coding agents is the same one the researcher draws: the sandbox and the network policy are the security boundary, and the model’s caution is not.