Claude Code was using 51,000 tokens before I even typed a prompt — I fixed it

Anthropic's Claude Code Opus 5 in Auto Mode can be manipulated to run malicious code when asked to summarize a website, according to prompt-injection researcher Johann Rehberger. The attack, successful in up to 80 percent of cases, involves tricking the coding model to use curl instead of its WebFetch tool to retrieve a malicious website's contents.

The website redirects to a ZIP archive containing a poisoned Python file named struct.py. Claude, following its safety protocols, declines to execute the decoder, but instead creates its own decoder that imports base64 and tricks the model into running the malicious struct.py code through Python module shadowing. This exploit can be used to launch a separate Python process that downloads and executes a remote payload, such as a command-and-control callback, or even create a new agent with its own tool access and context.

Across three attack variants tested, Rehberger reported success rates between 60 percent and 80 percent, though he notes these are from a small sample size. Anthropic did not respond to The Register's request for comment, but reportedly assured him that the model's behavior aligns with their design. To mitigate such attacks, Rehberger advises running coding agents in a sandbox and not trusting model output.