Researcher shows how Claude Code can be tricked simply by asking it to summarize a website

Anthropic's Claude Code in Auto Mode can be manipulated to run malicious code by simply asking it to summarize a compromised website, according to researcher Johann Rehberger. This attack has an 80% success rate, according to Rehberger's demo. The attacker presents a malicious website that masquerades as an archive of notebook records and tricks Claude into using curl instead of its WebFetch tool to retrieve the content.

When the WebFetch request fails, Claude decides to access the website directly and downloads a ZIP archive containing a malicious Python file named struct.py. Claude's safety measures prevent it from executing the decoder, but the attacker employs module shadowing to trick Claude into running the malicious code. This shadowing technique involves creating a local file with the same name as a Python standard-library module, causing Python to load the local file instead of the official module.

The malicious struct.py file is then used to create a separate Python process, downloading and executing a remote payload. This attack can be used to not only remotely execute code but also create a new agent with its own tool access and context. Rehberger suggests running coding agents in a sandbox and not trusting the model's output to mitigate such risks.