Cases › security breach › LR-2026-0687
Claude Code Opus 5 in Auto Mode tricked into running malicious code via website summary request
Confirmed Why: 2 independent outlets · 2 independent reports
Status: no action reported
No source states: loss or records, could do, deployer, industry.
Severity minor: contained to one limited lab test; the source states no third party was touched
An autonomous coding agent, Claude Code running Opus 5 in Auto Mode, was asked to summarize a website. The site served a ZIP archive containing a malicious Python file named struct.py. The agent refused to run a bundled native decoder binary, but wrote its own Python decoder and executed it from inside the extracted archive directory. Because Python searches the current directory first, the malicious struct.py shadowed a standard-library module and ran code during import, launching a child process that downloaded a later-stage payload and opened a command-and-control callback. The agent received valid decoded records and did not immediately recognise the hidden execution. The attack was reported from a limited lab test, with reported success in 60% to 80% of attempts. The researcher's lesson was that Auto Mode should not be treated as a security boundary.
What happened
What was done
No source states an action or fix.
Risks
Primary96 incidents
Rising: 24 vs 4.0 a week
Sorted by rule from the case's fields; not yet read from the sources.
Controls
ModelEffective Safety training and refusal
Control failure chain
L1 · ModelClaude Code Opus 5Model provider
Other controls for this risk at this layer, not mentioned in the sources: Cyber and weapons safeguards, Abuse monitoring and account enforcement, Staged or restricted release, Dangerous-capability testing before release, Outside red-teaming, Content safety classifiers, Safeguards kept on in testing, Reasoning monitoring.
L2 · HarnessClaude CodeAgent framework vendor
No source mentions a control at this layer.
L3 · ApplicationThe attackerDeployer
The attacker ran the agent; this layer was the attacker's own.
L4 · Infrastructure / targetOrganisation hit
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Known flaws patched, Multi-factor sign-in and password policy, Network segmentation, Intrusion and endpoint detection, Backups and recovery, Phishing and fraud filters.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Safety training and refusal | L1 Model | Effective |
| Content safety classifiers | L1 Model | Not stated in sources |
| Cyber and weapons safeguards | L1 Model | Not stated in sources |
| Dangerous-capability testing before release | L1 Model | Not stated in sources |
| Outside red-teaming | L1 Model | Not stated in sources |
| Staged or restricted release | L1 Model | Not stated in sources |
| Abuse monitoring and account enforcement | L1 Model | Not stated in sources |
| Reasoning monitoring | L1 Model | Not stated in sources |
| Safeguards kept on in testing | L1 Model | Not stated in sources |
| Known flaws patched | L4 Infrastructure / target | Not stated in sources |
| Multi-factor sign-in and password policy | L4 Infrastructure / target | Not stated in sources |
| Network segmentation | L4 Infrastructure / target | Not stated in sources |
| Intrusion and endpoint detection | L4 Infrastructure / target | Not stated in sources |
| Backups and recovery | L4 Infrastructure / target | Not stated in sources |
| Phishing and fraud filters | L4 Infrastructure / target | Not stated in sources |
Similar incidents
Evidence
- Cause a safeguard that was in place did not hold
No source states: what went wrong, what it reached or did, how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, what set it off, what was done.
Model versions this case names
Each link opens what the provider's documents state for that version, who tested it, and the safeguards it describes.
Show the full account: 5 items from the primary sources
What happened, in order
Not dated in the sources:
- Attack began with a request to summarize a website.
- Web-fetch tool call returned an HTTP 415 error.
- Agent switched to curl through a shell command.
- Agent refused to run the bundled native decoder binary.
- Agent wrote its own Python decoder.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
The claim that Anthropic showed a 0.00% prompt-injection success rate is attributed to Anthropic's prior testing and was not verified. No Anthropic fix or remediation for this incident is reported; remediations are source advice only.
LR-2026-0687 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON