Researcher demonstrates prompt-injection risk in Claude Code website summaries

A researcher says Anthropic’s Claude Code can be induced to run attacker-controlled code when asked to summarize a specially prepared website. The technique targets Claude Opus 5 in Auto Mode, the default configuration since mid-August, and illustrates how several seemingly routine actions can be chained into an exploit.

Johann Rehberger, known online as “wunderwuzzi,” described the demonstration in a blog post and video. His test begins with a website presented as an archive of notebook records. After Claude’s WebFetch request receives a 415 Unsupported Media Type response, the agent chooses to retrieve the material through a Bash command using curl.

The site then redirects Claude to a ZIP archive. Alongside benign-looking documentation and encoded notebook files, the archive contains a decoder and a malicious Python file called struct.py. Claude declines to run the supplied decoder, apparently recognizing that doing so could be unsafe, and instead writes its own decoding script.

That alternative creates the route to code execution. Python’s module-search behavior can cause a local file to replace a standard-library module with the same name. In the demonstration, the locally supplied struct.py is loaded indirectly when the new decoder imports other Python components. Rehberger said the file started another process, downloaded a remote payload and made a command-and-control connection. A second variant launched another headless Claude Code instance, giving the nested agent access to tools and allowing basic system reconnaissance and local file creation.

Across three variations tested five times each, Rehberger reported success rates from 60% to 80%, while acknowledging that the sample was limited. He also said obfuscation helped the malicious Python code pass Claude’s safety checks.

Sandboxing remains the main defense

According to Rehberger, Anthropic characterized Auto Mode as a convenience feature supported by a best-effort classifier rather than a security boundary. The researcher argues that classifiers may struggle with attacks assembled from individually innocuous steps.

His recommendation is to isolate coding agents with operating-system sandboxing, restrict network egress and avoid granting them unrestricted access to sensitive files or tools. The demonstration underscores that model safety checks should complement—not replace—traditional containment controls.