Critical security flaw in Claude Code allows malicious code execution
Researcher demonstrates how AI assistant can be hacked through website summarization feature
1Critical vulnerability in Claude Code
Anthropic's Claude Code AI can be tricked into executing malicious code through its website summarization feature. Security researcher Johann Rehberger proved this method works with an 80% success rate. The attack begins when the model in Auto Mode is triggered to use curl instead of its WebFetch tool, bypassing its security boundaries.
2Technical details of the attack
The attack chain starts by asking Claude to summarize a seemingly harmless website. The site returns a 415 error, forcing the model to use curl. A 303 redirect then downloads a malicious ZIP file containing a harmful struct.py file named identically to Python's standard modules, exploiting module shadowing techniques.
3Bypassing safety measures
Claude refuses to run the decoder binary in the ZIP, but this safety measure backfires. When the model writes its own decoder, it inadvertently executes malicious code. Rehberger used ChatGPT to obfuscate the payload to bypass Claude's safety checks, enabling remote code execution through this vulnerability.
4Secondary attack scenario
In a more dangerous variant, the malicious code can spawn a new Claude Code process. This 'nested' AI agent can run basic system commands like whoami and uname, open Calculator, and write files to the user's home directory. Rehberger found this scenario had a 60-80% success rate in testing.
5Anthropic's response
Anthropic stated the model is 'working as designed' and didn't acknowledge this as a security flaw. The company emphasized Auto Mode is a convenience feature without security guarantees. Rehberger argues OS isolation and network egress controls are the real solution to such vulnerabilities.
6Prompt injection threat
This attack demonstrates the danger of prompt injection chains composed of individually benign steps. The model's safety classifier isn't designed to block such complex attacks. The researcher stresses all coding assistants should run in sandboxed environments as protection.
7AI security trends
In 2024, security vulnerabilities in generative AI models are becoming increasingly prominent. Automatic tool usage in agentic systems creates new attack vectors. Industry experts warn against blindly trusting model outputs, especially in coding environments.
8Critical warning for users
This vulnerability should particularly concern developers. When using AI assistants like Claude Code, always prefer sandboxed environments. All code and commands generated by the model should be vetted for potential risks. As Rehberger emphasizes, the fundamental rule remains: 'Don't trust the model output'.