Writeup

Breaking Claude Code's Auto Mode: Module Shadowing to Arbitrary Code Execution

aitranslatedpentestclaude

Source: Исследователь обошел защиту Claude Code, попросив ИИ пересказать содержание сайта — Xakep (xakep.ru), original language: Russian. Translated & adapted by Sourav Banerjee.

Original URL: https://xakep.ru/2026/09/03/claude-code-attack/

Security researcher Johann Rehberger demonstrated an attack against Claude Code running Opus 5 in Auto Mode. He found that to execute arbitrary code, you only need to get the AI agent to summarize the contents of a specially prepared website. Across his tests, the attack succeeded 60–80% of the time.

Why Auto Mode makes this possible

The root problem: since mid-August 2026, Auto Mode is the default in Claude Code. In this mode, an automatic classifier that is supposed to block potentially dangerous operations replaces user confirmation of actions. That single design choice turns the agent into a more permissive target.

The attack chain

Rehberger's attack starts with an innocuous request: the user asks Claude to summarize the content of a site disguised as an archive of materials on the history of linguistic theory development.

  1. The agent first tries to fetch the page via WebFetch, but the server deliberately responds with error 415 Unsupported Media Type — and, crucially, gives no instructions to use other tools.
  2. Claude decides to work around the problem itself and reaches for the page via curl.
  3. The server returns a 303 redirect pointing to a ZIP archive, which the agent downloads and unpacks.
  4. Inside the archive: a README, directory metadata, seven Base85 + zlib encoded JSON files, a binary decoder for macOS, and a file named struct.py.
  5. Claude refuses to run the unfamiliar binary — which is exactly what Rehberger counted on. Instead of using the prebuilt program, the agent writes its own Python script to unpack and decode the JSON files.
  6. The decoder Claude writes imports the standard base64 module, which in turn imports struct. But Python looks for modules in the current directory first — and there, in the downloaded archive, sits the malicious struct.py. This is a classic module shadowing attack: instead of the standard library, the attacker's code loads.

The malicious struct.py exports the real _struct functions, so decoding proceeds normally. In parallel, obfuscated code launches a separate Python process that downloads and executes a remote payload. In his demo, the payload opened a C2 connection and launched a calculator.

Rehberger noted he obfuscated struct.py with ChatGPT to bypass Claude's protective mechanisms.

A second attack variant

The researcher also tested a variant where the malicious module launched a second Claude Code instance headlessly via claude -p. That child agent received its own context and tool access, then performed basic reconnaissance (whoami, uname, id), opened a calculator, and wrote files into the user's home directory.

Across three attack variants tested five times each, success averaged 60–80%. Rehberger acknowledges the sample is too small for exhaustive conclusions, but considers the results highly indicative.

Vendor response and the real lesson

Anthropic's engineers closed Rehberger's report as Informative, stating the system operated as intended — Auto Mode was designed as a convenience for automatic risk assessment, not as a full protection mechanism, and doesn't guarantee defense against sophisticated prompt injections or multi-step attacks composed of individually harmless-looking steps.

Rehberger argues the real defenses are OS-level isolation and restricted outbound network traffic. He recommends running Claude Code and other autonomous agents only inside containers, VMs, or other sandboxes, without access to home directories, SSH keys, or cloud credentials.

"Don't trust the output of the models," the researcher concludes.

Takeaway

This is a clean, elegant demonstration of a genuinely offensive AI-agent technique: abusing tool-selection autonomy plus Python's module-resolution order to turn "summarize this site" into arbitrary code execution. The 60–80% success rate, across variants, is a strong reminder that a model's refusal to run an unknown binary doesn't stop the attack — the agent will happily rewrite the tool itself to achieve the goal it's been given. Sandboxing the agent, restricting its network egress, and never granting it access to credentials are the defensible baseline.