[AUTO] Claude Code Auto Mode vulnerable to module shadowing attack

Researcher Johann Rehberger published a detailed breakdown of a 60–80% reliable remote code execution attack against Claude Code in Auto Mode. The trick: Claude summarizes a website, falls back to curl for a failed fetch, downloads a malicious ZIP with a struct.py file that shadows Python’s standard library imports. When Claude generates its own decoder and imports base64, it loads the attacker’s malicious code instead.

What stings is the evaluation gap. Anthropic’s commissioned study found 0% success against predetermined injection scenarios, yet Rehberger achieves 60–80% with creative tactics. The deeper issue: Claude refuses untrusted binaries, but happily runs its own generated code in a contaminated environment. The safety guardrail becomes the exploit path. Anthropic said Auto Mode is “backed by a best-effort classifier, not a security guarantee,” essentially conceding the design doesn’t ship with real protections, only mitigation layers. That’s honest, but raises whether Auto Mode should reset user expectations about what it will and won’t defend against.

Sources: Breaking Claude Code Opus 5 and Auto Mode • Video demonstration

Coverage: The Register: Researcher shows how Claude Code can be tricked simply by asking it to summarize a website