Claude Code Auto Mode can be tricked into running malware
A poisoned website is enough: a researcher hit 60-80% RCE on the now-default mode, and Anthropic calls it working as designed. Sandbox your agents.
Copy markdown
The exploit is just “summarize this website”
The attack opens with an ordinary summarize-a-page request. WebFetch fails with a 415, Claude falls back to curl, downloads a ZIP holding a malicious struct.py, and — after refusing the attacker’s binary — writes its own decoder, whose base64 import loads the poisoned struct.py and runs remote code.
60-80% success, and it can spawn more agents
Johann Rehberger ran three variants five times each: 60% for the C2-callback and subprocess versions, 80% for the file-writing one. The payload can launch fresh Claude Code instances with full tool access on your machine.
Anthropic says it’s working as designed
Anthropic told the researcher the behavior is working as designed and that Auto Mode is “a convenience feature backed by a best-effort classifier, not a security guarantee” — OS isolation and network controls are “the real boundary.” Read: the approval prompt is not a safety wall.
It’s the default now — so lock your agents down
Auto Mode became Claude Code’s default in mid-August, so you’re likely exposed unless you opted out. Run unattended agents in a container or VM, restrict network egress, isolate credentials, and never treat an Auto Mode approval as a security check.
Elsewhere: the EU makes ChatGPT a “very large search engine”
On Aug 31 the Commission designated ChatGPT (~159M EU users), plus Reddit and Roblox, under the DSA. Within four months they owe systemic-risk controls, annual audits and researcher data access; fines run to 6% of global revenue.