Claude Code Auto-Modus vulnerability allows malicious code execution

Security researcher Johann Rehberger has demonstrated that the ‘Auto-Modus’ feature in Anthropic’s Claude Code can be bypassed to execute malicious code. In tests, the researcher achieved success rates of up to 80 percent in running unauthorized code without manual user approval.

The vulnerability stems from a multi-step chain triggered by a seemingly harmless request to summarize a website. When the standard WebFetch tool fails, the AI agent autonomously switches to using the ‘curl’ command to retrieve data. This leads to the download of a ZIP archive containing a manipulated Python file named ‘struct.py’.

While the AI correctly identifies and refuses to run risky binary files, it inadvertently executes the malicious Python code through a technique known as module shadowing. By writing its own decoder and running it within the same directory as the manipulated file, the agent allows the malicious code to override the Python standard library during import.

Anthropic has stated that the Auto-Modus is intended as a convenience filter rather than a security guarantee, following previous audits by Trajectory Labs that reported a 0.00 percent success rate for prompt injection attempts against the Opus 5 model.