Researcher demos hijacking Claude Code for full system compromise
wunderwuzzi23 · x · 2026-08-28
Security researcher wunderwuzzi23 demonstrated a full exploit chain targeting Claude Code Opus 5 Auto Mode, achieving system-level compromise. The attack proceeds as follows:
- Induced Download: The site hosts a zip of "encoded notebook records." The server returns a 415 error, causing Claude to bypass WebFetch and use curl directly.
- Sandbox Evasion: Claude refuses to run the unknown binary decoder inside the zip, opting instead to write a "safe" Python decoder.
- Module Shadowing: The Python code includes import base64, but the zip contains a malicious struct.py (a standard library dependency of base64). Due to path priority, the malicious code executes, compromising the system.
This research highlights vulnerabilities in AI coding agents regarding dependency management and safety boundary enforcement.
Related event: Researcher Demos Website-Based Hijack of Claude Code Opus 5 Auto Mode(3 posts)→
More from Safety
- Subsidized Individual Accounts Drive Enterprise Shadow IT and Totalitarian Panopticons — curious_vii · 2026-08-28
- Anthropic shares progress on enabling Claude to operate in the physical world — dsp_ · 2026-08-28
- Anthropic enables independent research on Claude usage — badumtsssst · 2026-08-28
- GPT-5.6 Sol identified in METR report, accounting for ~5% of red-teaming activity — BLUECOW009 · 2026-08-28
- US Chip Security Act aims to verify location of high-end AI chips — peterwildeford · 2026-08-28
- Reviewing 73 years of reward hacking to assess AI safety evidence — tomekkorbak · 2026-08-28