{"schema_version":"0.10.0","id":"LR-2026-0745","record_version":1,"title":"Claude Code Auto Mode: website summary leads to remote code execution via Python module shadowing","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":47.0,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":3.52,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Tech Times · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Tech Times · subject to change"}]},"sources_hash":"d0d048ed5ba4e06438a975fd15fef64233eed2976ad6e35f089e756052202331"},"system":{"model_name":null,"model_version":null,"developer":"Anthropic","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"convenience feature backed by a best-effort classifier","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-09-01","incident_class":"security_compromise","failure_class":"silent_wrong_state","agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"Security researcher Johann Rehberger demonstrated a chain against Claude Code's Auto Mode, a feature in which a background classifier lets actions it judges safe proceed without asking the user. The exploit began with an ordinary request to summarize a web page. When the server returned an error to Claude's built-in fetch tool, Claude fell back to curl, downloaded a ZIP archive, and wrote its own Python decoder instead of running the supplied binary. Run from the extracted directory, Python loaded an attacker-supplied struct.py instead of the standard library module, which started a detached child process that fetched a remote payload. Anthropic's security team closed the report as informative and stated that the behavior is working as designed. In the lab, the payload opened Calculator and established a persistent callback, so the chain has been shown in testing rather than in a reported production incident.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"Test: minor (contained to one evaluation, no third party touched). Fact: the source reports lab results only and states no affected third party.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.techtimes.com/articles/326136/20260901/summarizing-website-claude-code-auto-mode-can-compromise-your-machine-no-fix-planned.htm","publisher":"Tech Times","date":"2026-09-01","type":"press","title":"Summarizing Website in Claude Code Auto Mode Can Compromise Your Machine; No Fix Planned - Tech Times","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.developer":"C","system.intended_use":"C","event.incident_class":"C","event.agent_involved":"C","event.failure_class":"C","event.detection_method":"C","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"Anthropic's security team, after reviewing Rehberger's disclosure, closed it as Informative and stated that the behavior is working as designed."}],"system.intended_use":[{"source_index":0,"quote":"The company's stated position is that Auto Mode is a convenience feature backed by a best-effort classifier — not a security guarantee."}],"event.incident_class":[{"source_index":0,"quote":"Security researcher Johann Rehberger has demonstrated that Claude Code's Auto Mode — marketed with a zero-percent prompt-injection attack success rate from a commissioned third-party evaluation — is vulnerable to a novel Python module-shadowing chain that achieves remote code execution with 60 to 80 percent reliability, depending on the variant."}],"event.agent_involved":[{"source_index":0,"quote":"Claude falls back to curl through its Bash tool on its own initiative."}],"event.failure_class":[{"source_index":0,"quote":"Rehberger's struct.py re-exports the real API so decoding continues without errors, giving Claude no visible sign that anything went wrong — until the C2 connection is established."}],"event.detection_method":[{"source_index":0,"quote":"Security researcher Johann Rehberger has demonstrated that Claude Code's Auto Mode — marketed with a zero-percent prompt-injection attack success rate from a commissioned third-party evaluation — is vulnerable to a novel Python module-shadowing chain that achieves remote code execution with 60 to 80 percent reliability, depending on the variant."}],"impact.severity":[{"source_index":0,"quote":"In the lab, the payload opened Calculator as immediate visual confirmation and established a persistent C2 callback."}],"impact.severity_because":[{"source_index":0,"quote":"In the lab, the payload opened Calculator as immediate visual confirmation and established a persistent C2 callback."}],"event.summary":[{"source_index":0,"quote":"Security researcher Johann Rehberger has demonstrated that Claude Code's Auto Mode — marketed with a zero-percent prompt-injection attack success rate from a commissioned third-party evaluation — is vulnerable to a novel Python module-shadowing chain that achieves remote code execution with 60 to 80 percent reliability, depending on the variant."},{"source_index":0,"quote":"Actions it judges safe proceed automatically."},{"source_index":0,"quote":"The malicious server returns an HTTP 415 Unsupported Media Type error."},{"source_index":0,"quote":"Claude falls back to curl through its Bash tool on its own initiative."},{"source_index":0,"quote":"Rather than running the supplied binary, Claude writes its own Python decoder to handle the archive's custom encoding."},{"source_index":0,"quote":"It finds struct.py there and loads it instead of the legitimate standard-library module."},{"source_index":0,"quote":"The detached child process outlives the Claude Code session."},{"source_index":0,"quote":"Anthropic's security team, after reviewing Rehberger's disclosure, closed it as Informative and stated that the behavior is working as designed."},{"source_index":0,"quote":"In the lab, the payload opened Calculator as immediate visual confirmation and established a persistent C2 callback."}]},"notes_on_gaps":"No agent model name or version is stated for the system that ran the exploit: Claude Sonnet 4.6 is named only for the classifier, and Opus 4.7 and Opus 5 appear only in test context. No occurrence date is stated, and the 2026-09-01 article date is not treated as a disclosure date. The disclosure date is not stated; the disclosure arrived twelve days after 2026-08-14 but no date is derived. The chain was demonstrated in lab runs; no production incident, affected party count, data exposure or loss is stated, so direct_loss, records and third-party counts are left out. Judgements made: failure_class silent_wrong_state, root_cause guardrail, autonomy supervised-auto, severity minor (contained to lab evaluation), harm_class none_materialised, and risks RK02, RK05, RK06 as most central. Trigger, responsible_party and detection timing are left out because no source states them as the cause or assigns responsibility; Anthropic's position is recorded as a stated position, not as a finding. Remediation: the source reports no patch, only advice; controls E1 and E2 are advised, and A4 was left out because the source's credential advice did not map cleanly to a control. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Tech Times · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"caught","text":"Security researcher Johann Rehberger found and demonstrated the chain, and published the disclosure.","quote":"Security researcher Johann Rehberger has demonstrated that Claude Code's Auto Mode — marketed with a zero-percent prompt-injection attack success rate from a commissioned third-party evaluation — is vulnerable to a novel Python module-shadowing chain that achieves remote code execution with 60 to 80 percent reliability, depending on the variant.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.techtimes.com/articles/326136/20260901/summarizing-website-claude-code-auto-mode-can-compromise-your-machine-no-fix-planned.htm"]},"analysis":{"sections":{"timeline":[{"text":"Trajectory Labs prompt-injection evaluation ran against Claude Code v2.1.205; this chain was not in its scenario set.","quote":"The Trajectory Labs evaluation commissioned by Anthropic tested 72 fixed scenarios, each run ten times, against Claude Code v2.1.205 as of July 17, 2026.","source_index":0,"when":"2026-07-17"},{"text":"Auto Mode became the default for Pro, Max, and Team plans.","quote":"Auto Mode became the default on August 14, 2026 for Pro, Max, and Team plans.","source_index":0,"when":"2026-08-14"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.techtimes.com/articles/326136/20260901/summarizing-website-claude-code-auto-mode-can-compromise-your-machine-no-fix-planned.htm"]}}