{"schema_version":"0.10.0","id":"LR-2026-0687","record_version":1,"title":"Claude Code Opus 5 in Auto Mode tricked into running malicious code via website summary request","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":54.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":3.84,"unhedged_language":4.17},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"2 independent outlets","original_document":null,"reports_total":2,"reports_independent":2,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"2 independent outlets"}]},"sources_hash":"9f05268f5c827c0b04cc796db00fc6ac5fda3751dd4219803f9555b84aef223c"},"system":{"model_name":"Claude Code Opus 5","model_version":null,"developer":"unknown","harness":"Claude Code","tools_granted":[],"permissions_scope":null,"autonomy_level":"supervised-auto","guardrails_present":["safety classifier"],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-08-28","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"An autonomous coding agent, Claude Code running Opus 5 in Auto Mode, was asked to summarize a website. The site served a ZIP archive containing a malicious Python file named struct.py. The agent refused to run a bundled native decoder binary, but wrote its own Python decoder and executed it from inside the extracted archive directory. Because Python searches the current directory first, the malicious struct.py shadowed a standard-library module and ran code during import, launching a child process that downloaded a later-stage payload and opened a command-and-control callback. The agent received valid decoded records and did not immediately recognise the hidden execution. The attack was reported from a limited lab test, with reported success in 60% to 80% of attempts. The researcher's lesson was that Auto Mode should not be treated as a security boundary.","tags":[],"date_detected":null,"near_miss":null,"root_cause":"guardrail","root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"control_chain":[{"layer":"L1","party":"provider","party_name":null,"control_id":"D1","outcome":"held","reason":null,"quote":"Claude correctly refused to run the included native decoder binary.","source_index":1,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"minor: contained to one limited lab test; the source states no third party was touched","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.theregister.com/research/2026/08/28/researcher-shows-how-claude-code-can-be-tricked-simply-by-asking-it-to-summarize-a-website/5293372","publisher":"The Register","date":"2026-08-28","type":"press","title":"Researcher shows how Claude Code can be tricked simply by asking it to summarize a website - The Register","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://cybersecuritynews.com/claude-code-opus-5-auto-mode-hijacked/","publisher":"CyberSecurityNews","date":"2026-08-28","type":"press","title":"Claude Code Opus 5 Auto Mode Hijacked via Prompt Injection to Execute Malicious Code - CyberSecurityNews","archived_url":null,"independence":"independent"}],"per_field_confidence":{"system.model_name":"C","system.harness":"C","system.autonomy_level":"C","system.guardrails_present":"C","event.root_cause":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.control_chain":"C","event.summary":"C","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.model_name":[{"source_index":1,"quote":"Claude Code Opus 5 in Auto Mode can be tricked into running malicious code via a simple website summary request."}],"system.harness":[{"source_index":1,"quote":"Claude Code Auto Mode is meant to reduce approval prompts."}],"system.autonomy_level":[{"source_index":1,"quote":"Instead of asking users to approve every command, it uses a safety classifier to review tool calls."}],"system.guardrails_present":[{"source_index":1,"quote":"Instead of asking users to approve every command, it uses a safety classifier to review tool calls."}],"event.root_cause":[{"source_index":1,"quote":"A classifier may deem a short command harmless without fully understanding the risks hidden in an archive, local import path, child process, or network request."}],"event.incident_class":[{"source_index":1,"quote":"The attacker included a file named struct.py, which shadowed Python’s legitimate standard-library struct module."}],"impact.severity":[{"source_index":1,"quote":"In a limited lab test, the attack reportedly succeeded in 60% to 80% of attempts."}],"impact.severity_because":[{"source_index":1,"quote":"In a limited lab test, the attack reportedly succeeded in 60% to 80% of attempts."}],"event.control_chain":[{"source_index":1,"quote":"Claude correctly refused to run the included native decoder binary."}],"event.summary":[{"source_index":1,"quote":"Claude Code Opus 5 in Auto Mode can be tricked into running malicious code via a simple website summary request."},{"source_index":1,"quote":"The website redirected the request to a ZIP archive containing catalog files, encoded records, a decoder binary, and a malicious Python file called struct.py."},{"source_index":1,"quote":"Claude correctly refused to run the included native decoder binary."},{"source_index":1,"quote":"But Claude executed the code from inside the extracted ZIP directory."},{"source_index":1,"quote":"The attacker included a file named struct.py, which shadowed Python’s legitimate standard-library struct module."},{"source_index":1,"quote":"In the proof-of-concept attack, the poisoned Python module launched another isolated Python process."},{"source_index":1,"quote":"As a result, Claude received valid decoded records and did not immediately recognize that a hidden payload had already executed."},{"source_index":1,"quote":"In a limited lab test, the attack reportedly succeeded in 60% to 80% of attempts."},{"source_index":1,"quote":"According to Embrace The Red, the key lesson is that Auto Mode should not be treated as a security boundary."}]},"notes_on_gaps":"Source 0 is a headline roundup from The Register with no Claude Code incident content, so it was not used. Only source 1 (CyberSecurityNews, press, reporting Embrace The Red research) describes the incident. No occurrence, disclosure or detection date is stated in the text, so no event dates were entered; the article date in source 0 header was not treated as a disclosure date. Trigger is not stated as a cause, so event.trigger was left out. Autonomy_level supervised-auto is my judgement from the description of Auto Mode reducing approval prompts via a classifier. Deployment context was not stated (described only as a limited lab test) and was left out. Success rates are reported as small-sample results and are recorded as reported. The claim that Anthropic showed a 0.00% prompt-injection success rate is attributed to Anthropic's prior testing and was not verified. Detection method public_researcher is my inference from the research being done by Embrace The Red. No Anthropic fix or remediation for this incident is reported; remediations are source advice only. Duration, containment time, records, loss and affected parties are not stated and were left out. Severity minor is my judgement: a limited lab test with no third party touched. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (2 independent outlets)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"The agent was given a normal-looking request to summarize a website.","quote":"The attack started with a normal-looking instruction: summarize a website.","source_index":1,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.theregister.com/research/2026/08/28/researcher-shows-how-claude-code-can-be-tricked-simply-by-asking-it-to-summarize-a-website/5293372","https://cybersecuritynews.com/claude-code-opus-5-auto-mode-hijacked/"]},"analysis":{"sections":{"timeline":[{"text":"Attack began with a request to summarize a website.","quote":"The attack started with a normal-looking instruction: summarize a website.","source_index":1,"when":null},{"text":"Web-fetch tool call returned an HTTP 415 error.","quote":"When Claude tried to use its web-fetching tool, the server returned an HTTP 415 error.","source_index":1,"when":null},{"text":"Agent switched to curl through a shell command.","quote":"Claude then chose to use curl through a shell command to retrieve the site directly.","source_index":1,"when":null},{"text":"Agent refused to run the bundled native decoder binary.","quote":"Claude correctly refused to run the included native decoder binary.","source_index":1,"when":null},{"text":"Agent wrote its own Python decoder.","quote":"Instead of executing the untrusted binary, Claude wrote its own Python decoder to process the encoded files.","source_index":1,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.theregister.com/research/2026/08/28/researcher-shows-how-claude-code-can-be-tricked-simply-by-asking-it-to-summarize-a-website/5293372","https://cybersecuritynews.com/claude-code-opus-5-auto-mode-hijacked/"]}}