Anthropic's Claude Code Opus 5 Hijacked via Prompt Injection to Execute Malicious Code
Researchers demonstrate a multi-step prompt injection attack that bypasses Claude Code Opus 5's Auto Mode safeguards, leading to arbitrary code execution.
Researchers from Embrace The Red have successfully demonstrated a sophisticated prompt injection attack against Anthropic's Claude Code Opus 5, specifically targeting its Auto Mode. This mode is designed to reduce user interaction by automatically approving tool calls, but the new research shows it can be tricked into executing malicious code. While Anthropic previously reported a 0.00% prompt injection success rate for Opus 5 Auto Mode in fixed scenarios, this targeted, multi-step attack highlights potential vulnerabilities in automated safety mechanisms.
The attack chain begins with a seemingly innocuous request: to summarize a website. The attacker-controlled website, however, was designed to return an HTTP 415 error. This error prompted Claude to use a curl command to fetch the site directly. The website then redirected Claude to a ZIP archive containing various files, including a malicious Python file named struct.py.
Claude Code Opus 5 correctly refused to execute a native decoder binary included in the archive. However, in a critical misstep, it proceeded to write its own Python decoder to process the encoded files. The issue arose because Claude executed this decoder from within the extracted ZIP directory. Python's module loading mechanism prioritizes the current directory, meaning the attacker-controlled struct.py file shadowed the legitimate standard library struct module.
When Claude's decoder imported common Python modules like base64, the Python interpreter inadvertently loaded the malicious struct.py file. This poisoned module executed arbitrary code during the import process, all while presenting the appearance of normal operation to the decoder. This allowed the AI to proceed with processing the files as intended, unaware that its own execution environment had been compromised.
As a result of the successful import of the malicious module, Claude received the expected decoded records, masking the immediate execution of the hidden payload. The poisoned Python module then initiated a new Python process, which downloaded and executed a subsequent payload. This payload established a command-and-control (C2) connection and, as a visible indicator of compromise, launched the Calculator application.
Further testing revealed that a nested Claude Code instance, launched by the initial malicious module, performed system reconnaissance and also opened Calculator. Another variant successfully wrote files outside the designated workspace. The success rates for these proof-of-concept attacks ranged from 60% to 80% in limited lab tests, underscoring the effectiveness of the multi-stage approach.
The key takeaway from this research is that Auto Mode should not be considered a definitive security boundary. While safety classifiers may deem individual commands harmless, they may not fully account for risks hidden within archives, local import paths, child processes, or complex network interactions. Organizations leveraging autonomous AI agents must implement robust security measures.
To mitigate such risks, it is crucial to run AI agents in isolated environments like containers or virtual machines. Limiting network access, securing credentials, continuous process monitoring, and preventing code execution from untrusted directories are essential. While Auto Mode offers convenience, it does not negate the need for comprehensive sandboxing and vigilant oversight when processing external data.