Cases › security breach › LR-2026-0745
Claude Code Auto Mode: website summary leads to remote code execution via Python module shadowing
Preliminary Why: 1 report: Tech Times · subject to change · 1 independent report
Status: no action reported
No source states: loss or records, agent tool, could do, deployer, industry.
Severity minor: Test: minor (contained to one evaluation, no third party touched). Fact: the source reports lab results only and states no affected third party.
Security researcher Johann Rehberger demonstrated a chain against Claude Code's Auto Mode, a feature in which a background classifier lets actions it judges safe proceed without asking the user. The exploit began with an ordinary request to summarize a web page. When the server returned an error to Claude's built-in fetch tool, Claude fell back to curl, downloaded a ZIP archive, and wrote its own Python decoder instead of running the supplied binary. Run from the extracted directory, Python loaded an attacker-supplied struct.py instead of the standard library module, which started a detached child process that fetched a remote payload. Anthropic's security team closed the report as informative and stated that the behavior is working as designed. In the lab, the payload opened Calculator and established a persistent callback, so the chain has been shown in testing rather than in a reported production incident.
What happened
What was done
No source states an action or fix.
Risks
Primary63 incidents
Rising: 5 vs 2.2 a week
Also96 incidents
Rising: 24 vs 4.0 a week
Sorted by rule from the case's fields; not yet read from the sources.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
HarnessTool allow-list · Fail-closed defaults · Stop control
ApplicationHuman approval for high-impact actions · Change review and separation of duties · Least-privilege access for the agent · Production kept apart from test · Activity logs · Adversarial testing before deployment
Infrastructure / targetSimilar incidents
Evidence
No source states: what the AI was doing, what went wrong, what it reached or did, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 2 items from the primary sources
What happened, in order
- 2026-07-17 Trajectory Labs prompt-injection evaluation ran against Claude Code v2.1.205; this chain was not in its scenario set.
- 2026-08-14 Auto Mode became the default for Pro, Max, and Team plans.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
The disclosure date is not stated; the disclosure arrived twelve days after 2026-08-14 but no date is derived. Remediation: the source reports no patch, only advice; controls E1 and E2 are advised, and A4 was left out because the source's credential advice did not map cleanly to a control.
LR-2026-0745 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON