Researcher shows how Claude Code can be tricked simply by asking it to summarize a website
A security researcher has shown that Anthropic’s Claude Code can be induced to execute malicious code while summarising a hostile website. The demonstration matters because Claude’s default Auto Mode may make its own tool choices after a web request fails, allowing a prompt-injection chain to turn apparently routine browsing into local code execution.
In the test, the site redirected Claude to a ZIP archive containing a malicious Python file called `struct.py`; when Claude wrote its own decoder, Python module shadowing caused that file to run. Researcher Johann Rehberger reported success rates of 60–80% across three small-sample variants, including one that created a second headless Claude agent with its own tool access. Anthropic reportedly said Auto Mode is a convenience feature rather than a security guarantee, while Rehberger urged users to sandbox coding agents and restrict network access.
- Malicious websites can reportedly trigger code execution through Claude Code’s Auto Mode.
- The attack abused redirects, downloaded archives and Python module shadowing.
- Sandboxing and network controls remain essential safeguards.
New here? Start with this
Claude Code is Anthropic’s AI assistant for software development. It can use tools to work with files and websites, and its Auto Mode can choose some actions on its own. Websites can contain hidden or misleading instructions aimed at influencing an AI system, a risk known as prompt injection.
Python, the programming language involved in the demonstration, can load code from files when running a task. If a file is given the same name as a standard Python module, it can sometimes be loaded in its place, a behaviour called module shadowing. This can make a file’s contents run unexpectedly.
The issue matters because coding assistants may have access to a user’s files, tools and network connection. Anthropic makes Claude Code, while security researcher Johann Rehberger studies ways AI systems can be misused; their differing roles help explain the debate over how much protection an automatic mode should provide.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Auto Mode can make Claude Code more useful by letting it respond flexibly when a web request fails, and the demonstration shows that even a routine summarising task can expose unexpected paths to code execution. Users and developers may therefore see the findings as a reason to strengthen safeguards, such as sandboxing agents and limiting network access, while continuing to benefit from automation.
The case against
A successful demonstration does not by itself show how often this chain would affect users in ordinary conditions: the reported rates came from small samples and particular test variants. Anthropic’s position that Auto Mode is a convenience feature rather than a security guarantee reflects the view that users should treat coding agents as tools requiring appropriate isolation, rather than assume that every browsing action is safe by default.