What happened
A security researcher who publishes under the name wunderwuzzi, on the blog Embrace The Red, released a working attack on August 26. It gets Claude Code to run malicious code on its own while operating in Auto Mode.
Auto Mode is how Claude Code now decides whether to run a command without stopping to ask you first. A separate small AI model, called a classifier, reviews each action Claude wants to take and blocks anything that looks irreversible or destructive. We covered Auto Mode becoming the default on Pro, Max, and Team plans about three weeks ago.
At the time, Anthropic said a third-party firm ran 720 prompt injection attempts against Auto Mode and recorded a 0.00% success rate. Prompt injection is when text an agent reads, like a webpage or a downloaded file, tries to trick it into doing something you never asked for.
The new test used a much smaller sample. But it shows something that number doesn’t rule out: a real, reproducible chain of individually normal-looking steps that ends in code execution, rather than one obviously dangerous command a classifier would flag.
The setup starts with an ordinary request: “Summarize this webpage.” Claude’s web-reading tool fails to load the page, so Claude decides on its own to retry using curl, a command-line tool for downloading files. It runs that through Claude Code’s Bash tool, the feature that executes real terminal commands on your machine. The download turns out to be a ZIP archive. Inside are encoded data files, plus a program called decoder-darwin and a Python file named struct.py.
Claude refuses to run the unfamiliar decoder-darwin program, which is the right call. Instead, it writes its own Python script to decode the data and runs that script from inside the folder it just unzipped. That choice is the trap. Python looks in the current folder first for files it needs, including its own built-in struct module. The archive planted a fake struct.py in that same folder. Claude’s script loads the attacker’s fake version instead of Python’s real one, and malicious code runs the moment it’s imported.
wunderwuzzi reported the finding to Anthropic’s bug bounty inbox, the address where Anthropic collects security reports and pays researchers who find real flaws, before publishing it. Anthropic responded quickly and closed the report as “Informative,” its label for behavior working as designed rather than a bug that needs a fix.
Why it matters
Auto Mode’s classifier is built to catch a single command that looks dangerous on its own, like deleting a folder or sending a file somewhere external. That’s what the earlier 0.00% figure measured: attacks structured as one bad move a reviewer would catch.
This attack never hands the classifier one obviously bad move. Retrying a failed web request with curl is normal. Writing your own script instead of running an unfamiliar program is a reasonable, even cautious, decision. Running that script is what a coding agent does constantly. Each step looks fine by itself. The risk only shows up in how the steps connect, through a Python quirk that neither a person nor, apparently, the classifier would think to check.
That gap matters more because Auto Mode is not something you opted into. It’s the default now. We also reported that Claude Code added automatic session resumption two weeks ago, so a task can keep running unattended even after you’ve stepped away from your computer. Combine both features and a chained attack like this one has more room to run before anyone notices.
Who should care
Anyone running Claude Code with Bash access who asks it to look at content from outside your own project. Summarizing a webpage, reading a linked document, or opening a file someone sent you all count. That’s routine work, not an edge case. If Auto Mode is your only safety net for tasks like that, this finding is worth knowing.
It matters less if you already run Claude Code inside a restricted environment that limits what it can reach on the network, since that protection doesn’t depend on the classifier catching every clever chain of steps.
What builders should do next
Claude Code already ships that kind of restriction: a built-in sandbox for the Bash tool. Run /sandbox inside a Claude Code session to open its setup panel. From there, you can limit which files Bash commands can read or write and which network addresses they’re allowed to reach. The operating system enforces that boundary directly, instead of relying on the classifier to catch every risky pattern. Restricting outbound network access for unattended agents was also wunderwuzzi’s own recommendation after this test, which is exactly what the sandbox’s network rules do.
Turn it on for one project where Claude Code handles content you didn’t write yourself: a docs site, a downloaded file, a webpage. Then run a normal task and confirm two things: the task still finishes, and an attempt to reach an address outside your allow list gets blocked. That tells you more about your actual exposure than either Anthropic’s 0.00% figure or wunderwuzzi’s result, since your risk depends on what your own setup can already reach.
Auto Mode isn’t broken by this finding, and Anthropic isn’t wrong that it beats how most people used manual approval before it. But “working as intended” and “safe by default against untrusted content” are different claims. Treat the classifier as one layer of protection, not the whole wall.
End of article