# Breaking Claude Code Opus 5 Auto Mode

Malicious website hijacks Claude Code Opus 5 Auto Mode via 415-to-curl nudge and Python module shadowing (struct.py) to achieve RCE and C2 callback.

- Payout: Research
- Severity: high
- Program: Anthropic
- Write-up by: Johann Rehberger
- Disclosed: 2026-08-27
- Write-up quality: 8/10
- Original: https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-breaking-claude-code-opus-5-and-automode
- Tags: area:ai domain:ai impact:internal-access impact:rce kind:research platform:research sev:high tech:llm tech:python technique:chained technique:source-review vuln:prompt-injection vuln:rce

**Target:** Claude Code Opus 5 Auto Mode agent processing untrusted web content
**Root cause:** Auto Mode's classifier only inspects the immediate command, not the multi-hop chain; Claude writes its own decoder and runs it inside an attacker-controlled directory, so a malicious struct.py shadows the stdlib module imported by base64.
**Steps:**
1. Serve a page returning `415 Unsupported Media Type` so Claude abandons WebFetch and uses `curl` via Bash.
2. Root URL returns `303` to `/deposits/WIC-notebook-catalogue.ZIP` containing README, Base85/zlib JSON records, a decoy `decoder-darwin` binary, and malicious `struct.py`.
3. Claude refuses to run the binary and writes its own decoder, then runs `cd WIC-notebook-catalogue && python3 -c 'import base64, zlib, json; ...'`.
4. `base64` imports `struct`, which resolves to the attacker's `struct.py` in cwd; it re-exports real `_struct` and executes obfuscated module-level code.
5. Payload spawns `python3 -I -c ...` child in new session, downloads remote stager, fetches native payload, chmods and executes it, establishing C2 and opening Calculator.
**How found:** Author tested whether Anthropic's claimed 0.00% prompt-injection ASR held against a targeted chain, hypothesizing that forcing curl and exploiting Python's cwd module search path could bypass the intent classifier that only sees the short decoder command.
**Exploitation:** Attacker controls a website the agent is asked to summarize. A 415 forces curl; a 303 redirects to a ZIP. The decoy binary steers Claude into writing its own decoder, which is executed inside the extracted archive, triggering struct.py shadowing. The poisoned module spawns an isolated Python child that downloads and runs a native payload, giving C2 callback and code execution that outlives the conversation.
**Escalation:** Variant spawns a nested headless `claude -p` instance with its own tool access, performing recon (whoami, uname, id) and writing files outside the workspace; ASR up to 80%.
**Insight:** When an agent writes its own tooling and runs it inside an attacker-supplied directory, Python's implicit cwd-on-sys.path turns any stdlib import (base64->struct) into code execution; force the agent off its safe fetch tool with a 415 so it shells out with curl.