Claude Code Auto Mode bypassed with a simple website summary
Ask Claude Code to summarize a webpage. Get remote code execution. That is the attack chain security researcher Johann Rehberger just demonstrated against Claude Code running Claude Opus 5 in Auto Mode.
How the Attack Worked
Rehberger, who publishes under the handle wunderwuzzi at Embrace The Red, found the vulnerability using indirect prompt injection. The attacker embeds malicious instructions inside a webpage. When Claude Code fetches and summarizes that page, it reads the hidden instructions and executes them as if they came from the user.
The specific technique involved Python module shadowing via a file named struct.py. By dropping a malicious module into a directory Claude Code would load from, the injected code could run with the same permissions as the agent itself. The result was remote code execution.
Why Auto Mode Made This Worse
Auto Mode became the default operating mode for Claude Code in mid-August. In Auto Mode, the agent takes actions with reduced interruptions and confirmation prompts. That design choice is what makes it productive for developers. It is also what made this attack chain possible without a human stopping it mid-execution.
The attack bypassed Auto Mode’s guardrails entirely. A routine user request, summarize this URL, was enough to start the chain.
The Operator Takeaway
If you are running Claude Code in Auto Mode on a machine with network egress and write access to your project directory, the attack surface is wider than most developers assume. Fetching external URLs is a standard task for coding agents. Indirect prompt injection turns every untrusted webpage into a potential attack vector.
The research does not name a patch status from Anthropic. Until there is a documented fix, the practical mitigations are familiar: sandbox your agent environments, restrict network egress where possible, and treat any agent that can both read external URLs and write to disk as a high-trust process that needs tight boundaries.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
