Researcher bypasses Claude Code Auto Mode with malicious ZIP exploit

August 28, 2026 at 06:37 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Security researcher Johann Rehberger bypassed Anthropic's Claude Code Auto Mode, achieving remote code execution up to 80% of the time. The exploit used a malicious ZIP archive and Python library hijacking to trick Claude into running malware. Anthropic had claimed Auto Mode blocked prompt-injection attacks with near-zero success.

Key Facts

Johann Rehberger demonstrated an exploit that bypasses Claude Code Auto Mode with up to 80% success rate.
Anthropic claimed Auto Mode had a 0.00% prompt injection attack success rate in independent evaluations.
The attack used a malicious ZIP archive and Python library hijacking to achieve remote code execution.
Rehberger recommends isolating and monitoring AI agents even when Auto Mode is enabled.

The Exploit

Rehberger created a website posing as an archive of notebook records stored in a ZIP file. The site included plausible metadata, dates, checksums, and seven short records to appear legitimate. When Claude attempted to fetch the page with WebFetch, the server returned a 415 Unsupported Media Type error. Claude then used curl to fetch the page, and the server responded with an HTTP 303 redirect to a malicious ZIP archive. The attack hijacked the model's decision path rather than directly instructing it, making the malicious route appear as the solution to its objective.

Anthropic's Security Claims

Anthropic introduced Auto Mode as a safer replacement for the --dangerously-skip-permissions flag. In default Auto Mode, Claude proceeds unless an action appears irreversible, destructive, or aimed outside the environment. Anthropic reported that no attack in an independent evaluation was successful against any of its models with Auto Mode enabled. The company's chart showed a 0.00% prompt injection attack success rate in browser use and tool calling.

Researcher's Warning

Rehberger stated that Auto Mode is not a substitute for running an agent in an isolated environment and monitoring its activity. He warned that simply asking Claude Code to summarize a website can lead to complete compromise. The researcher emphasized the importance of isolation and monitoring for AI agents, even with Auto Mode enabled.