Researcher tricks Claude Code into running malware

Security researcher Johann Rehberger, known online as wunderwuzzi, got Claude Code's Auto Mode to run arbitrary code with nothing more than a request to summarize a fake website, no jailbreak prompt required. In testing, the attack succeeded 60 to 80 percent of the time across variants.

The chain works by exploiting how Claude recovers from a failed tool call. When Claude's own web-fetch tool errors out on the malicious page, it falls back to running curl through Bash, exactly what the attacker anticipated. That request pulls down a poisoned ZIP file containing a malicious struct.py, a file deliberately named to collide with Python's standard library module of the same name. When Claude later writes its own decoder script rather than execute a supplied binary, importing the standard base64 module pulls in the malicious local struct.py instead of the real one, handing an attacker code execution inside whatever the agent has access to. In Rehberger's demonstrations, that meant popping a calculator or spawning new Claude Code agents with their own independent tool access.

Anthropic's response, per Rehberger's writeup, was that Auto Mode is "a convenience feature backed by a best-effort classifier, not a security guarantee," and that the behavior is working as designed. There is no built-in fix inside Claude Code itself.

For anyone running agentic coding tools against real repositories or real infrastructure, the practical takeaway is to treat model output as untrusted by default: run coding agents inside a sandboxed environment with restricted OS access and locked-down network egress, rather than relying on Auto Mode's classifier to catch a malicious page before it reaches a shell. This is the same module-shadowing pattern that has bitten Python dependency resolution for years, applied to an agent that will happily write its own workaround code when a safety check blocks the obvious path.