Ask an AI coding assistant to summarize a webpage, and you’d expect a summary back. Nothing more. That basic assumption just took a hit, and it says something important about where AI agent security actually stands going into the fall.

Security researcher Johann Rehberger, who publishes under the handle wunderwuzzi at Embrace The Red, found a way to hijack Claude Code running in Opus 5’s Auto Mode using nothing more exotic than a request to summarize a website. No malicious attachment from the user. No obvious red flag in the prompt. Just a normal-looking task that an agent handles a hundred times a day.

Auto Mode became the default way Claude Code runs in mid-August. Instead of stopping to ask permission before every command, it leans on a safety classifier to decide what’s fine to execute on its own. That’s the whole pitch: less friction, more autonomy, an agent that gets on with the work instead of pinging you for approval every few seconds.

Here’s how the attack played out. Claude tried to fetch the target site using its WebFetch tool and received an HTTP 415 (Unsupported Media Type) error. So it fell back to curl instead, a reasonable move for any developer or agent. Curl pulled down a ZIP file the site presented as an archive of notebook records, complete with believable metadata. Inside sat a poisoned file named struct.py, built to shadow Python’s own standard library module of the same name.

Claude did one thing right here. It refused to run a binary decoder bundled in the archive, because executing an unknown binary is an obvious risk. So it wrote its own decoder script instead. That script imported Python’s base64 module, which in turn needed struct. Python first found the attacker’s version in the local working directory and loaded it instead of the real one. That single import was enough to trigger remote code execution and open a callback to a command-and-control server.

Rehberger reports this worked between 60% and 80% of the time across test variants. That’s a hard number to square with Anthropic’s own claim of a 0.00% attack success rate from third-party red-team testing. The gap comes down to scope: that evaluation covered 72 fixed test scenarios, and this particular attack chain wasn’t one of them. It’s a reminder that a clean benchmark result describes the tests you ran, not the attacks nobody’s tried yet.

One more detail stands out. Once Claude realized something had gone wrong and tried to clean up after itself, Auto Mode’s own approval system blocked the cleanup command. The same guardrail that let the malicious code run in the first place also stopped the agent from fixing its own mistake.

Anthropic closed the report as “Informative” rather than treating it as a vulnerability to patch. Its position, as described in Rehberger’s writeup, is that Auto Mode is a best-effort classifier, not a security guarantee, and that determined, multi-step attack chains fall outside what it’s meant to catch. The company’s stated view is that the real boundary has to be OS-level isolation and control over network egress, not a smarter approval prompt.

That framing matters, because agentic tooling isn’t staying confined to a terminal window anymore. Mitch Ashley, VP and practice lead for software lifecycle engineering and AI-native software engineering at The Futurum Group, put it this way: “AI, agents, and early agentic AI are appearing in software organizations beyond developer IDEs and command line tools. We are seeing a rapid rise in vendors releasing AI solutions for planning work, building agents, fixing software issues, AI model flexibility, infrastructure management, and operational monitoring and troubleshooting.” Every one of those integration points inherits the same trust assumptions this attack just picked apart. An agent that can fetch a URL, run a shell command, and write its own code is powerful precisely because it can chain small, ordinary actions together. That’s also exactly what made this exploit work.

None of this means autonomous coding agents are unusable. It means the safety net most teams are counting on is thinner than the marketing around “auto mode” features suggests. The actual fix isn’t a better classifier or a friendlier approval dialog. It’s sandboxing agents in containers or VMs, locking down network egress, and keeping credentials isolated from whatever the agent is running. Those are infrastructure decisions, not settings toggles, and they land squarely on the platform and DevOps teams already building the pipelines these agents plug into.

For anyone rolling out AI coding agents with real system access, this is worth treating as a checklist item rather than a headline to skim past. An approval from Auto Mode indicates the classifier didn’t flag anything. It doesn’t tell you the code is safe. Those two things sound similar. They aren’t the same, and the gap between them is exactly where this attack lived.