Claude Code Auto Mode tricked into running malware
Security researchers showed that Claude Code's Auto Mode can be tricked by a booby-trapped website into downloading and running a hidden program, even though the user only asked it to summarize a web page. In lab tests the attack worked 60 to 80 percent of the time.
- Report priority
- Medium
- Targets
- Claude Code+2 more
How it works
- The malicious website makes Claude's normal web-fetch tool fail, which pushes Claude to use its command-line tool instead to download a ZIP file.
- That ZIP contains a file named struct.py, and because Python checks the current folder for files before its own built-in ones, Claude's own decoding script loads the fake struct.py instead of Python's real one...
What to do
Anthropic says real protection should come from operating-system isolation and network controls, not the approval check, so run Claude Code's Auto Mode inside a sandboxed or disposable environment with restricted outbound internet access rather than trusting it to catch a malicious download on its own.
Technical details
Affected software: Claude Code, Anthropic, Auto Mode
A user asks Claude Code, running in Auto Mode, to summarize a website. The site makes Claude's web-fetch tool fail, so Claude switches to its command-line tool and downloads a ZIP archive instead. Claude writes its own Python script to decode files inside the archive, and because Python looks in the current folder for files first, it loads a booby-trapped file named struct.py instead of Python's real one. That file quietly starts a second program, which in the researcher's test opened the Calculator app as proof it worked and kept running after the Claude Code session ended.
The chain starts when a site causes Claude's WebFetch to return an HTTP 415 error, prompting Claude to fall back to its Bash tool and pull a ZIP archive via curl. Claude wrote its own decoder for the archive's base85, zlib, and JSON-encoded contents rather than running the bundled native binary, which it had refused. Because Python searches the current working directory for modules before the standard library, its decoder imported an attacker-supplied struct.py instead of Python's real struct module. That file re-exported the real low-level functions so decoding still worked, but also launched a second Python process that downloaded and ran a payload, opening a command-and-control connection.