Prompt Injection Attack Hijacks Claude Code Opus 5 Auto Mode to Execute Malicious Code

A prompt-injection demonstration has shown how Anthropic’s Claude Code Opus 5 can be steered from a website-summary task into executing attacker-controlled code when it operates in default Auto Mode.

The research from Johann Rehberger, known online as “wunderwuzzi,” does not describe a conventional instruction such as “run this command.”

Instead, the malicious website shapes the agent’s problem-solving path until it selects unsafe actions itself. Across five-run samples, the researcher reported success rates ranging from 60% to 80%, while cautioning that the tests are not a comprehensive benchmark.

Prompt Injection Attack Hijacks Claude Code Opus 5 Auto Mode

The chain starts with a request to summarize a purported archive of notebook records. Claude attempts to retrieve the page using WebFetch, but the server returns HTTP 415 Unsupported Media Type.

Running the Malware (Source: Embrace The Red)

The site does not explicitly require a shell command; however, in observed runs, the failure persuades Claude to fall back to curl via its Bash tool. A redirect then delivers a ZIP archive disguised as a catalog.

Inside are credible-looking metadata, a checksum manifest, encoded records, a README, a macOS decoder binary, and a Python file named struct.py .

Claude commonly refuses to run the supplied native decoder, but then writes a replacement Python decoder for the Base85-, zlib-, and JSON-encoded records. That safer-looking decision becomes the execution vector.

The decoder is launched from the extracted directory. Because Python searches the current directory early when resolving imports, base64 ’s attempt to import struct can load the archive’s attacker-controlled struct. py rather than the standard-library component.

The malicious file re-exports the _struct interface, allowing decoding to appear normal, while an obfuscated import-time expression launches a separate Python process to download and execute a remote payload.

Claude Code Opus 5 in Auto Mode can be tricked into running malicious code via a simple website summary request. In a limited lab test, the attack reportedly succeeded in 60% to 80% of attempts.

The finding from Embrace The Red is significant because Anthropic previously highlighted testing in which Opus 5 Auto Mode showed a 0.00% prompt-injection success rate across a fixed set of scenarios.

However, the new research suggests that targeted, multi-step attacks can still bypass automated safeguards. Claude Code Auto Mode is meant to reduce approval prompts.

Instead of asking users to approve every command, it uses a safety classifier to review tool calls. Anthropic positions the feature as safer than unrestricted permission skipping, but it is not designed to replace a sandbox or operating-system security controls.

Claude Code Opus 5 Auto Mode Hijacked

The attack started with a normal-looking instruction: summarize a website. The attacker-controlled website appeared to host an archive of notebook records. When Claude tried to use its web-fetching tool, the server returned an HTTP 415 error.

Claude then chose to use curl through a shell command to retrieve the site directly. The website redirected the request to a ZIP archive containing catalog files, encoded records, a decoder binary, and a malicious Python file called struct. py.

The payload establishes C2 and immediately opens Calculator as a visible effect (source: Embracethered )

Claude correctly refused to run the included native decoder binary. However, this safety decision set the stage for the next stage of the attack.

Instead of executing the untrusted binary, Claude wrote its own Python decoder to process the encoded files. The decoder imported common Python modules such as base64, zlib, and json. But Claude executed the code from inside the extracted ZIP directory.

Python searches the current directory when loading modules.