Claude Code Auto Mode Compromised: Website Summary Leads to RCE
wunderwuzzi23 · x · 2026-09-01
Security researcher @wunderwuzzi23 demonstrated an attack chain that hijacks a machine running Claude Code Opus 5 in auto mode, starting from a simple website summarization task.
Attack Vector:
- The target is asked to summarize a website containing a malicious archive.
- Claude Code refuses to run the attacker's binary decoder but writes its own Python decoder instead.
- The Python script runs inside the unpacked directory, where an import base64 statement inadvertently loads the attacker's payload.
Key Insight:
- Each individual action appears locally reasonable, yet the trajectory results in full system compromise.
- Highlights that agents are being granted more agency faster than permission constraint systems are being built.
More from coding & agent
- Simon Willison: code mode is the future of tool calling, if it can be sandboxed — springrod · 2026-10-16
- Dev workflow: Astra for tedious tasks, Claude for ideas not implementation — menhguin · 2026-10-16
- Agent named 'Ilya' reportedly scores 1.1pt higher on benchmarks — daniel_mac8 · 2026-10-16
- Gemini CLI fix: substring matching inlined unrequested binary files into model context — priyanshu1976 · 2026-10-16
- Building AI agents on real healthcare claims data: the domain work that makes them work — alex_verem · 2026-10-16
- OpenAI stealth-testing mysterious internal model 'Aeon' in Codex desktop app and Dots — cedric_chee · 2026-10-16