--- title: A researcher hijacked Claude Code by asking it to... description: A security researcher, Johann Rehberger, demonstrated that Claude Code running in Auto Mode (the default since mid-August) can be hijacked simply by asking it... canonical: https://daily.dev/posts/a-researcher-hijacked-claude-code-by-asking-it-to-summarise-a-web-page-qdxiqonwb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A researcher hijacked Claude Code by asking it to summarise a web page | daily.dev og:description: A security researcher, Johann Rehberger, demonstrated that Claude Code running in Auto Mode (the default since mid-August) can be hijacked simply by asking it... og:url: https://daily.dev/posts/a-researcher-hijacked-claude-code-by-asking-it-to-summarise-a-web-page-qdxiqonwb og:image: https://api.daily.dev/og/posts/QDXiqonwb.png og:image:alt: A researcher hijacked Claude Code by asking it to summarise a web page og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A researcher hijacked Claude Code by asking it to summarise a web page **[The Next Web](https://daily.dev/sources/tnw)** · 5 min read · 0 upvotes · 0 comments ## Summary A security researcher, Johann Rehberger, demonstrated that Claude Code running in Auto Mode (the default since mid-August) can be hijacked simply by asking it to summarize a web page, achieving arbitrary code execution between 60% and 80% of the time across test runs. The attack chain exploits Claude's own safe behavior: when the model refuses to run a supplied decoder binary, it writes its own decoder, which imports Python's base64 module, which in turn imports struct - and Python loads the attacker's malicious struct.py from the local directory instead of the real module (classic module shadowing). This let the researcher launch a separate process that called out to a command-and-control server, or in another variant, spawn a fresh headless Claude Code session with its own tool access. Anthropic told the researcher the behavior is working as designed, describing Auto Mode as a convenience feature backed by a best-effort classifier rather than a security guarantee, and recommends OS-level sandboxing and network egress control as the real defense. Separately, Anthropic also announced it is raising standard weekly Claude Code limits by 25% from September 14, which actually represents a 17% reduction compared to the temporary 50% boost currently in effect. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can asking Claude Code to summarize a webpage lead to code execution? Claude Code in Auto Mode can be tricked into executing attacker code because when it refuses to run a malicious decoder binary (per its safety training), it writes its own decoder instead. That decoder imports Python's base64 module, which imports struct, and Python loads the attacker's local struct.py instead of the real one, a classic module shadowing flaw. Researcher Johann Rehberger achieved success in 60-80% of attempts across three tested variants. _Teams running autonomous coding agents track disclosures like this on daily.dev before trusting default settings._ ### What did Anthropic say about the Claude Code Auto Mode prompt injection vulnerability found by Johann Rehberger? Anthropic told the researcher the behavior is working as designed, characterizing Auto Mode as a convenience feature backed by a best-effort classifier rather than a security guarantee. The company did not respond to a follow-up press request about the finding. Rehberger argues the real protection has to come from operating system isolation and network egress control, and recommends running coding agents in a sandbox rather than trusting model output. _Developers weighing agent autonomy against risk follow responses like this on daily.dev._ ### Is Anthropic increasing or decreasing Claude Code usage limits in September? Anthropic is resetting standard weekly Claude Code limits to 25% above baseline starting September 14, down from the temporary 50% increase currently in effect, which Anthropic itself confirmed amounts to a 17% reduction in weekly limits compared to current usage. The announcement was framed publicly as a permanent 'raise' of 25%, but multiple outlets reported it as a net cut. _Teams budgeting Claude Code usage watch limit changes like this on daily.dev before they land._ ## Similar posts on daily.dev - [Researcher shows how Claude Code can be tricked simply by asking it to summarize a website](https://daily.dev/posts/researcher-shows-how-claude-code-can-be-tricked-simply-by-asking-it-to-summarize-a-website-qpwpa0y3k) · The Register · 0 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#anthropic](https://daily.dev/tags/anthropic), [#claude-code](https://daily.dev/tags/claude-code), [#appsec](https://daily.dev/tags/appsec), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/a-researcher-hijacked-claude-code-by-asking-it-to-summarise-a-web-page-qdxiqonwb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"A researcher hijacked Claude Code by asking it to summarise a web page","url":"https://daily.dev/posts/a-researcher-hijacked-claude-code-by-asking-it-to-summarise-a-web-page-qdxiqonwb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/a-researcher-hijacked-claude-code-by-asking-it-to-summarise-a-web-page-qdxiqonwb"},"datePublished":"2026-09-01T16:21:07.458Z","dateModified":"2026-09-02T02:02:04.158Z","description":"A security researcher, Johann Rehberger, demonstrated that Claude Code running in Auto Mode (the default since mid-August) can be hijacked simply by asking it...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5617d317f653a5a793560f8f3261c71a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5617d317f653a5a793560f8f3261c71a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/a-researcher-hijacked-claude-code-by-asking-it-to-summarise-a-web-page-qdxiqonwb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,anthropic,claude-code,appsec,prompt-injection","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"A researcher hijacked Claude Code by asking it to summarise a web page"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/a-researcher-hijacked-claude-code-by-asking-it-to-summarise-a-web-page-qdxiqonwb#faq","mainEntity":[{"@type":"Question","name":"How can asking Claude Code to summarize a webpage lead to code execution?","acceptedAnswer":{"@type":"Answer","text":"Claude Code in Auto Mode can be tricked into executing attacker code because when it refuses to run a malicious decoder binary (per its safety training), it writes its own decoder instead. That decoder imports Python's base64 module, which imports struct, and Python loads the attacker's local struct.py instead of the real one, a classic module shadowing flaw. Researcher Johann Rehberger achieved success in 60-80% of attempts across three tested variants. Teams running autonomous coding agents track disclosures like this on daily.dev before trusting default settings."}},{"@type":"Question","name":"What did Anthropic say about the Claude Code Auto Mode prompt injection vulnerability found by Johann Rehberger?","acceptedAnswer":{"@type":"Answer","text":"Anthropic told the researcher the behavior is working as designed, characterizing Auto Mode as a convenience feature backed by a best-effort classifier rather than a security guarantee. The company did not respond to a follow-up press request about the finding. Rehberger argues the real protection has to come from operating system isolation and network egress control, and recommends running coding agents in a sandbox rather than trusting model output. Developers weighing agent autonomy against risk follow responses like this on daily.dev."}},{"@type":"Question","name":"Is Anthropic increasing or decreasing Claude Code usage limits in September?","acceptedAnswer":{"@type":"Answer","text":"Anthropic is resetting standard weekly Claude Code limits to 25% above baseline starting September 14, down from the temporary 50% increase currently in effect, which Anthropic itself confirmed amounts to a 17% reduction in weekly limits compared to current usage. The announcement was framed publicly as a permanent 'raise' of 25%, but multiple outlets reported it as a net cut. Teams budgeting Claude Code usage watch limit changes like this on daily.dev before they land."}}]} ```