The security researcher Johann Rehberger demonstrates in an analysis published on August 26 how the automatic release mode of Claude Code can be bypassed with a prepared archive file. In test runs, the complete attack chain with remote access was successful in three out of five cases, a simpler variant in four out of five cases. Anthropic assesses the finding as informative, not as a security vulnerability.
Prepared ZIP file smuggles in malicious code
The attack begins with a manipulated website: If the server responds with the HTTP status code 415, Claude Code switches from the built-in WebFetch tool to the command line and downloads the file instead via curl. This very switch opens, according to Rehberger, the crucial gap because the software then works with a downloaded ZIP file in the file system.
The archive contains, in addition to seemingly harmless catalog data, a macOS decoder, encrypted JSON records, and a prepared file named struct.py. Claude Code correctly refuses to execute the supplied decoder but instead writes its own Python script for decryption. This seemingly safe decision becomes a trap: If the script imports the standard module base64 from the unpacked directory, Python loads the identically named prepared file from the archive instead of the real system library due to so-called module shadowing.
The hidden code starts an isolated subprocess, loads another program stage, establishes a connection to a control server, and visibly opens the calculator as proof of execution. According to Rehberger, the malicious process continues to run even after the Claude Code session has long been terminated.
Protection mechanism blocks its own emergency stop
In test series with small sample sizes, the complete attack chain including control server connection was successful in three out of five attempts, a reduced variant with file accesses outside the working directory in four out of five cases. Rehberger himself points out that the numbers come from small sample sizes and do not represent an independently verified success rate. Simon Willison independently confirmed the finding and emphasizes that an auto mode release alone is not a security proof for executed code.
A notable detail from the tests is that Claude recognized the compromise in one case, but the auto mode refused the command to terminate the malicious process – while it had previously allowed the creation of the malware. The auto mode has replaced the manual release of individual commands for Pro, Max, and Team accounts since August 14 with a classifier that is supposed to autonomously stop risky actions. The change was primarily intended to compensate for human negligence: According to an in-house study, test subjects overlooked nine out of ten risky commands during manual review, which the automatic classifier reliably stopped.
Anthropic refers to sandboxing as the actual protection
Rehberger reported the finding through the company’s bug bounty program. Anthropic classified the report as informative, not as a security vulnerability, and stated according to company information that the auto mode is “a convenience feature based on a classifier to the best of its ability, not a security guarantee.” The actual layer of protection is operating system isolation and restrictions on network access, not the classifier itself.
The finding stands in contrast to Anthropic’s own metric: The company had advertised an auto mode independent test with 72 withheld attack scenarios and a total of 720 attempts, in which not a single attack was successful. This fixed test series does not cover the technique used by Rehberger – a result of zero percent on a limited scenario catalog does not exclude new, creative attack paths such as module shadowing.
The researcher advises developers to run coding agents in containers, virtual machines, or operating system sandboxes, restrict network access, and keep sensitive data such as SSH keys away from the working environment.
It remains open whether Anthropic will retrain the classifier with this specific technique or will mandate sandboxing in the future. For teams that are already using coding agents productively, the finding shifts the responsibility from the software back to their own system architecture – those who do not operate a sandbox rely solely on a classifier that the manufacturer explicitly does not describe as a security guarantee.
