A web page walks Claude Code's Auto Mode into running an attacker's payload

What happened

Johann Rehberger published a five-step chain that starts when the agent is asked to read a page. The server answers WebFetch with an HTTP 415 so the model falls back to curl, then hands back a ZIP holding encoded files and a decoy binary. Rather than run the binary, the agent is led into writing its own Python decoder, and a malicious struct.py sitting in the extracted directory shadows the standard-library module that decoder pulls in. The obfuscated code then downloads and runs a remote payload.

Rehberger measured the chain over five-run samples: three of five for a variant that called back to a server he controlled, three of five for a Claude subprocess doing reconnaissance, and four of five for a Claude subprocess writing files. He describes the figures as representative of a motivated attack rather than comprehensive. He says Anthropic closed the report through its bug bounty as informative, treating Auto Mode as a best-effort classifier rather than a security guarantee, and pointing to operating-system isolation and network egress control as the real boundary. No CVE was assigned, and the work is a demonstration on video rather than anything seen in the wild.