Reported by 2 outlets
Prompt Injection in Claude Code Opus 5 Auto Mode Enables Malicious Code Execution
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.57 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Prompt Injection Attack Hijacks Claude Code Opus 5 Auto Mode to Execute Malicious Code
gbhackers.com · 46d ago · August 28th, 2026
A recent demonstration of prompt-injection research has revealed that Claude Code Opus 5, when running in its default Auto Mode, can be manipulated to execute malicious code via a seemingly harmless website summary request. Security researcher Johann Rehberger, who writes under the name “wunderwuzzi” at Embrace The Red, reported success rates of 60% to 80% […] The post Prompt Injection Attack Hijacks Claude Code Opus 5 Auto Mode to Execute Malicious Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Prompt Injection Attack Hijacks Claude Code Opus 5 Auto Mode to Execute Malicious Code
cyberpress.org · 46d ago · August 28th, 2026
A prompt-injection demonstration has shown how Anthropic’s Claude Code Opus 5 can be steered from a website-summary task into executing attacker-controlled code when it operates in default Auto Mode. The research from Johann Rehberger, known online as “wunderwuzzi,” does not describe a conventional instruction such as “run this command.” Instead, the malicious website shapes the agent’s problem-solving path until it selects unsafe actions itself. Across five-run samples, the researcher reported success rates ranging from 60% to 80%, while cautioning that the tests are not a comprehensive benchmark. Prompt Injection Attack Hijacks Claude Code Opus 5 Auto Mode The chain starts with a request to summarize a purported archive of notebook records. Claude attempts to retrieve the page using WebFetch, but the server returns HTTP 415 Unsupported Media Type. Running the Malware (Source: Embrace The Red) The site does not explicitly require a shell command; however, in observed runs, the failure persuades Claude to fall back to curl via its Bash tool. A redirect then delivers a ZIP archive disguised as a catalog. Inside are credible-looking metadata, a checksum manifest, encoded records, a README, a macOS decoder binary, and a Python file named struct.py . Claude commonly refuses to run the supplied native decoder, but then writes a replacement Python decoder for the Base85-, zlib-, and JSON-encoded records. That safer-looking decision becomes the execution vector. The decoder is launc