Claude Code Auto Mode (Opus 5) — module-shadowing chain turns 'summarize this page' into RCE; Anthropic: working as designed

View raw markdownEdit on GitHub ↗

TL;DR

Two independent researchers showed within the same fortnight that Claude Code's Auto Mode — the default since mid-August 2026, in which Claude decides for itself which tools to run without asking — can be walked into executing attacker code from nothing more than a "summarize this website" request. Johann Rehberger's chain (published 2026-08-26) succeeded in 60–80% of trials; a second researcher's steganographic variant succeeded in 6 of 10. Neither needed a jailbreak: every individual step looked benign to the safety classifier, and in Rehberger's chain the step that fired the payload was Claude refusing to run a suspicious binary and writing its own Python decoder instead — which imported a poisoned struct.py sitting in the directory it had just unpacked. Anthropic closed the report as "Informative": Auto Mode is "a convenience feature backed by a best-effort classifier, not a security guarantee." No fix is planned. Treat Auto Mode approval as no evidence that a command is safe, and run the agent inside a sandbox with egress control.

What happened

The chain (Rehberger, embracethered.com, 2026-08-26)

  1. The user asks Claude Code to summarize a URL. Claude's WebFetch tool tries it.
  2. The attacker's server answers HTTP 415 (Unsupported Media Type). Claude falls back to curl in bash.
  3. The redirect lands on a ZIP archive. Claude downloads and unpacks it: encoded "records," a binary decoder, and some Python files.
  4. Claude declines to run the supplied binary — the safety behaviour working as intended.
  5. Claude writes its own small Python decoder to finish the task, and runs it from the extracted directory.
  6. That decoder does import base64. Python's import resolution searches the script's own directory first, so the attacker's struct.py in the unpacked folder shadows the standard library module that base64 depends on. The poisoned module runs.
  7. The payload launches a remote stager, which fetches native malware with a command-and-control callback.

No single step is a "run this malware" instruction. The classifier that backs Auto Mode scores actions, and each action — fetch, fall back to curl, unpack, refuse the binary, write a helper, run the helper — is individually reasonable. Rehberger's line: "Ironically, that safety decision is the exploit path."

Three variants were tested five times each: a python3 -I -c chain to a C2 stager (3/5), a claude -p subprocess doing reconnaissance and launching Calculator (3/5), and a claude -p subprocess writing files (4/5). Small samples, but consistent with the second researcher's numbers.

The second, independent chain (IT Meets OT, itmeetsot.eu)

A separate researcher tested Claude Code 2.1.228, Opus 5 in auto mode, with Sonnet 5 as the safety classifier. Here the instructions were hidden steganographically in the repository's only image — split the luminance plane into 8×8 blocks, DCT each, read the signs of low-frequency coefficients as ASCII — and the write-up describes "adversarial trajectory guidance": soft nudges spread across the chain that steer the model toward the unsafe action rather than one blunt instruction. Execution was achieved by having the agent wrap untrusted code in sys.addaudithook(), a Python mechanism documented as not being a security boundary. Success in 6 of 10 trials; the classifier blocked the other four. (The post's URL carries a 2026-08-12 date; the fetched page references an update on 2026-08-29 acknowledging Rehberger's parallel findings.)

Two researchers, two delivery mechanisms (HTTP content-negotiation fallback vs. image steganography), two execution primitives (module shadowing vs. an audit hook), one root cause: Auto Mode's classifier evaluates steps, and a chain of individually-benign steps is not a benign chain.

Anthropic's response

Rehberger first sent the report to Anthropic's model bug-bounty address and received no response, then re-filed through the security reporting channel. Anthropic closed it as "Informative," "working as designed." Its stated position, quoted by the researcher and by The Next Web: Auto Mode is "a convenience feature backed by a best-effort classifier, not a security guarantee," determined prompt-injection chains built from benign steps fall outside the classifier's scope, and OS isolation and network controls are the actual security boundary. Anthropic did not respond to The Register's request for comment.

That position is defensible engineering — and it is also the reason this entry is active rather than mitigated: the default configuration of the most widely used AI coding CLI now ships a mode whose approval signal the vendor itself says should not be relied on, and the mitigation is entirely on the user.

Why this matters for vibe coders

  • Auto Mode is the default now. If you installed or updated Claude Code after mid-August 2026 and didn't change anything, you're in the mode both researchers tested. Rehberger's post notes Auto Mode became the default in mid-August.
  • The entry point is ordinary. "Summarize this page" and "look at this repo" are the two most common things people ask a coding agent to do with untrusted input.
  • This is the 0DIN DNS Setup Trap pattern generalised. That advisory documented Claude Code's error-recovery automation being steered through a failing package init; this one steers it through a failing content type. Error recovery is a decision the agent makes on its own, and every such decision is a step an attacker can choose for it.
  • It composes with everything else in this repo. A repo that already carries a GitSpawn config, a TrapDoor-style CLAUDE.md, or an aider .aider.conf.yml now also gets to include an image.

Am I affected?

You are exposed if you run Claude Code in Auto Mode (the default since mid-August 2026) against content you did not author, outside an OS-level sandbox with restricted egress.

claude --version           # 2.1.228 was the build in the steganography test; the chain is behaviour, not a version bug
# Look for Python files named after stdlib modules sitting in project or download directories —
# the module-shadowing primitive needs one of these next to a script the agent will run:
find ~ -maxdepth 4 \( -name 'struct.py' -o -name 'base64.py' -o -name 'json.py' -o -name 'os.py' \) \
     -not -path '*/site-packages/*' -not -path '*/lib/python*' 2>/dev/null
# Review recent agent sessions for a WebFetch → curl fallback followed by an archive unpack:
grep -rl 'curl' ~/.claude/projects/ 2>/dev/null | head

If a session matches that shape and you weren't running in a container, assume the payload ran with your user's credentials.

If you are affected

playbooks/if-your-local-ai-agent-was-exploited.md, then playbooks/rotating-cloud-credentials.md. The stager fetched native malware — a compromised host, not just a leaked token.

Prevention

  • prevention/agent-sandboxing.md — the vendor's own answer. Container, VM, or OS sandbox; egress allow-list (both chains phone home); no SSH keys or cloud credentials mounted into the agent's environment.
  • Do not treat Auto Mode approval as review. If you want a human gate on network fetches and archive extraction, leave Auto Mode off for untrusted input.
  • Don't assume interpreter flags close the shadowing path — Rehberger's 60% variant ran under python3 -I -c and still succeeded. The durable fix is procedural: never execute anything, including a helper the agent just wrote, from inside an unpacked untrusted archive; copy the script to a clean directory first, or don't run it.
  • Both researchers' mitigation advice reduces to Rehberger's closing line: "Do not trust the model output."

Sources