Claude Code Security Flaw: Code Execution via Website Summarization
Researcher demonstrates how Claude Code can be tricked into executing code by summarizing a website.
1Claude Code's Security Flaw
Anthropic's Claude Code model can be tricked into executing attacker-controlled code by asking it to summarize a website. This attack is effective in Auto Mode, the model's default setting. Johann Rehberger detailed this vulnerability in his blog and video demo. The attack begins by asking the model to summarize a malicious website and proceeds by tricking it into using curl.
2How the Attack Works
The attack starts by making the model use curl instead of its WebFetch tool. When the WebFetch request fails, the model accesses the website directly using Bash with curl. The website redirects to a malicious ZIP archive, which Claude downloads. The archive contains seemingly harmless files along with a malicious Python file.
3Model's Security Decision
Claude, due to its safety guardrails, refuses to use the supplied binary and writes its own decoder. However, this decision opens the exploit path as intended by the attacker. The model imports the base64 module, and through Python module shadowing, the malicious code is executed.
4Module Shadowing Technique
Module shadowing occurs when a local file shares the same name as a Python standard library module. In this case, the standard base64 module imports the legitimate struct module, but the malicious ZIP file contains a file with the same name, causing the malicious code to be executed.
5Obfuscating Code with ChatGPT
Rehberger used ChatGPT to obfuscate the malicious struct.py code, bypassing Claude's safety controls. This successfully launched a separate Python process to download and execute a remote payload, which in this case was a command-and-control callback that opened Calculator.
6Nested Claude Instances
In another attack scenario, struct.py launches a second headless Claude Code instance. This allows not just remote code execution but the creation of a new agent. The nested Claude instance performs basic reconnaissance and writes to local files.
7Attack Success Rates
Rehberger tested three variants five times each and reported success rates between 60% and 80%. These results are representative of a motivated attack but not comprehensive. Anthropic stated that the model's behavior is working as designed.
8Solution Recommendations
Rehberger recommends running this and other coding agents in a sandbox. He emphasizes not trusting the model output. Auto Mode is a convenience feature, not a security guarantee, and OS isolation and network egress control are the real boundaries.