Prompt-injection chain hijacks Claude Code Opus 5 Auto Mode into malware with up to 80% success

A security researcher has demonstrated a prompt-injection attack that hijacks Claude Code running Opus 5 in Auto Mode, turning an ordinary website-summary request into arbitrary code execution and a command-and-control callback. According to the write-up on the Embrace the Red blog, which reached the Hacker News front page, the attack succeeded 60-80% of the time on a small sample — against a configuration that an Anthropic-commissioned evaluation had scored at 0.00%.

From web summary to shell

The test scenario is deliberately mundane: asking Claude to summarize an archive website. The researcher redacted the domain and serves the malicious content only to allow-listed IPs, and the site itself presents as a small catalogue of digitized notebook records.

Claude Code initially uses its WebFetch tool, but the server replies with HTTP 415 Unsupported Media Type. Nobody tells the model to switch tools; it decides on its own to retry with curl inside a Bash call. The post describes this as a core hijacking technique: the attack never instructs the model, it just arranges the environment so the harmful route becomes the most sensible way to finish the task. In some runs Claude reportedly started with curl directly.

The curl request follows a redirect to a ZIP archive holding plausible material: a README, catalogue metadata, a SHA-256 manifest, seven Base85/zlib-encoded JSON records, a native macOS decoder binary and a file named struct.py.

The refusal that becomes the exploit

Faced with the supplied decoder binary, Claude correctly refuses to execute it — which is exactly what the attacker planned. Instead, it writes its own small Python decoder and runs it from inside the extracted archive directory. That safety decision is the exploit path.

Python puts the working directory on its module search path, the standard-library base64 module imports struct, and the archive ships a malicious struct.py that shadows the real module while re-exporting the low-level _struct API so decoding continues normally. During import, a heavily obfuscated module-level expression executes.

That code launches an isolated Python child using python3 -I (isolated mode, so the child does not recursively load the poisoned struct.py — a mitigation the post notes Claude itself could have applied). The child downloads and runs a remote Python stage, which fetches a native test payload, makes it executable and launches it. In the lab this established a C2 callback and opened Calculator as a visible cue, and the detached process can outlive the Claude conversation. The obfuscation was written with ChatGPT and designed to survive simple string searches.

Auto Mode and the 0.00% evaluation

Auto Mode, which replaces Claude Code's human approval prompts with a safety classifier, has been the default starting mode since mid-August, according to the post. The researcher's central point: if you worry about misalignment, hallucinations or prompt injection, Auto Mode is not a substitute for running the agent in an isolated environment and monitoring it.

The backdrop is a claim by Anthropic's Boris Cherny that layered defenses — model training, input probes and an intent classifier — could cut indirect prompt injection on unseen attacks to roughly zero. Anthropic hired the vendor Trajectory Labs to test 72 indirect prompt-injection scenarios, ten runs each, and the shared chart showed a 0.00% attack success rate for Opus 5 in Auto Mode. The post notes the evaluation appears to have no published benchmark name. Against a purpose-built chain rather than a generic suite, the researcher measured up to 80% success.

Compromise outruns detection

In several runs the machine was already compromised while Claude kept calmly decoding records; only afterwards did it inspect struct.py and react. The researcher also deliberately performed a real C2 callback rather than just popping Calculator, having observed that some models tolerate a Calculator launch even when they suspect an attack, since opening an app looks harmless.

Why it matters

The distance between a 0.00% vendor evaluation and a 60-80% targeted chain shows how little generic scenario suites predict about adversaries who design the environment around the model's reasoning. The failure mode is inverted safety: refusing an untrusted binary and trusting self-written code is precisely what triggers the module-shadowing exploit. And because Auto Mode is now the default, many Claude Code users run with approval prompts replaced by a classifier that, in this demonstration, saw only a short benign-looking decoder while the real payload executed several hops away. The practical guidance matches earlier prompt-injection research: treat everything an agent fetches as untrusted input, and run code-executing agents in sandboxed, monitored environments.