Claude Code Auto Mode Compromised: Website Summary Leads to RCE
wunderwuzzi23 · x · 2026-09-01
Security researcher @wunderwuzzi23 demonstrated an attack chain that hijacks a machine running Claude Code Opus 5 in auto mode, starting from a simple website summarization task.
Attack Vector:
- The target is asked to summarize a website containing a malicious archive.
- Claude Code refuses to run the attacker's binary decoder but writes its own Python decoder instead.
- The Python script runs inside the unpacked directory, where an import base64 statement inadvertently loads the attacker's payload.
Key Insight:
- Each individual action appears locally reasonable, yet the trajectory results in full system compromise.
- Highlights that agents are being granted more agency faster than permission constraint systems are being built.
More from coding & agent
- AI Coding Widens Output Variance; Judgment Becomes the Key — dotey · 2026-09-01
- Who Has Authority When AI Agents Cross Multiple Systems? — FactivalUniverse · 2026-09-01
- Get Zcode from Zai with GLM account; works well with GLM 5.3 Flash — DevDminGod · 2026-09-01
- Guide to Onboarding Existing AI/ML Projects: From Setup to Data Tracing — kmeanskaran · 2026-09-01
- Atlas Agent Supports Full Multimodal Input with Retrieval Pipelines — BenBajarin · 2026-09-01
- RLMs May Compose Search as a Tool Using Grep, Regex, and ColBERT — CShorten30 · 2026-09-01