Loading story…
A proof-of-concept indirect prompt-injection attack reportedly induced Claude Code Opus 5 in Auto Mode to execute attacker-controlled code after processing a malicious website during an ostensibly benign summarization task. The chain caused the agent to fall back from WebFetch to curl, download and extract a ZIP archive, then create and run a Python decoder inside the attacker-controlled extraction directory. A bundled struct.py abused Python import-path precedence to shadow the standard-library struct module when the decoder imported Base64-related functionality, enabling a staged payload to contact attacker-controlled command-and-control infrastructure and launch Calculator.
The researcher reported success rates of 60% for Python/C2 and nested Claude subprocess variants, and 80% for a variant that opened Calculator and wrote outside the designated workspace, in limited testing. Anthropic reportedly categorized the disclosure as Informative, stating that Auto Mode is a convenience capability governed by a best-effort classifier rather than a security boundary. Organizations running autonomous coding agents against untrusted content should isolate the runtime, restrict outbound network access, withhold sensitive credentials, constrain filesystem access, and monitor agent-created processes and tool calls.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
According to researcher Johann Rehberger, Claude Code began using Auto Mode by default in mid-August 2026. Auto Mode uses an automated classifier in place of user confirmations for potentially dangerous actions.
The researcher submitted the issue through Anthropic's model bug-bounty email and security reporting channel. Anthropic reportedly closed it as Informative, stating that Auto Mode is a convenience feature with a best-effort classifier rather than a security boundary, and that OS isolation and network-egress controls are the relevant protections.
In a variant of the proof of concept, the malicious import launched a headless nested Claude Code instance via claude -p. The nested agent reportedly ran whoami, uname, and id, opened Calculator, and wrote files under the user's home directory or outside the original workspace.
Embrace The Red demonstrated a lab proof of concept in which an attacker-controlled website induced Claude Code Opus 5 Auto Mode to use curl, download a redirected ZIP archive, and execute a self-written Python decoder from the extracted directory. A malicious struct.py shadowed Python's standard-library module, enabling a staged payload to call back to a controlled C2 server and open Calculator; reported success rates ranged from 60% to 80% across variants.
A third-party evaluation commissioned by Anthropic and conducted by Trajectory Labs reportedly recorded a 0.00% prompt-injection attack success rate for Claude Code Opus 5 Auto Mode across 72 scenarios, each run 10 times.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
5 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcetheregister.com
Open sourcecybersecuritynews.com
Open sourcecyberveille.ch
Open sourceembracethered.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers and CERT/CC reporting highlighted **critical prompt-injection-to-execution paths** in agentic AI systems where untrusted content can be interpreted as instructions and then executed via connected tools. In *ModelScope MS-Agent*, **CVE-2026-2256** (CVSS 9.8) was reported as a **command injection / RCE** issue tied to the framework’s “Shell tool,” where external input is not properly sanitized before being passed to OS command execution; a `check_safe()` denylist-based filter was described as bypassable via obfuscation/alternate syntax, enabling arbitrary command execution and potential full host compromise. Separate research from **Zenity Labs** described a broader class of **agentic AI browser** weaknesses (including Perplexity’s *Comet*) where attackers can hijack autonomous workflows using indirect prompt injection delivered through normal channels such as a **calendar invite**; prior to patches, this could drive the browser to access local files, read directories/files, and exfiltrate data, and in some cases leverage the agent’s existing authenticated context to interact with sensitive services (including password managers). A similar execution-model risk was reported in *Langflow*’s CSV Agent as **CVE-2026-27966** (CVSS 10.0), where `allow_dangerous_code=True` was hardcoded, enabling LangChain’s `python_repl_ast` tool and allowing remote attackers with chat access to coerce **server-side code execution** and full system compromise via prompt injection.
Jun 29, 2026
Researchers disclosed **PromptFiction**, a vulnerability in Anthropic’s Claude Desktop app that let a crafted `claude://` link automatically open the application and submit an attacker-controlled prompt without requiring the user to review or press send. Oasis Security reported the issue through Anthropic’s responsible disclosure program, and Anthropic patched the behavior in Claude Desktop version `1.1.2321` so prompts delivered through the custom URI scheme are only pre-filled for manual review before submission. The flaw could be delivered through websites, documents, emails, chat messages, or search results, and researchers said attackers could hide malicious instructions using benign padding and Claude’s message-folding behavior. On its own, the bug enabled reliable prompt injection and possible exfiltration of prior conversation data or abuse of connected tools; when chained with previously disclosed **Claudy Day** issues and environments using Anthropic’s official Filesystem Server, it could allow local file read/write access, persistence, malicious code planting, and ultimately **remote code execution** on the victim machine.
Jul 15, 2026
AI Now Institute disclosed **"Friendly Fire,"** a proof-of-concept attack showing that autonomous AI coding agents used to inspect or secure software repositories can be manipulated into executing attacker-controlled code on the host system. The demonstration targeted **Anthropic Claude Code** and **OpenAI Codex** when autonomous command-approval features were enabled, and used a malicious `README` prompt plus a disguised binary invoked through a script named `security.sh` while reviewing an untrusted open-source repository. Researchers said the issue is a **design-level weakness** rather than a patchable, version-specific flaw, because the agents cannot reliably separate hostile repository content from instructions that appear relevant to their assigned task. The proof of concept, built from a modified **geopy** repository, reportedly required no elevated privileges or trust prompt and achieved code execution without user approval; AI Now said it has not observed in-the-wild abuse, released public research code with the payload removed, and urged organizations to keep command-capable agents away from untrusted codebases and sensitive environments.
Jul 10, 2026