A security researcher has shown that Anthropic’s Claude Code can be induced to execute malicious code while summarising a hostile website. The demonstration matters because Claude’s default Auto Mode may make its own tool choices after a web request fails, allowing a prompt-injection chain to turn apparently routine browsing into local code execution.

In the test, the site redirected Claude to a ZIP archive containing a malicious Python file called `struct.py`; when Claude wrote its own decoder, Python module shadowing caused that file to run. Researcher Johann Rehberger reported success rates of 60–80% across three small-sample variants, including one that created a second headless Claude agent with its own tool access. Anthropic reportedly said Auto Mode is a convenience feature rather than a security guarantee, while Rehberger urged users to sandbox coding agents and restrict network access.