Claude Code vulnerability exposed via prompt injection

Researcher Johann Rehberger, known as ‘wunderwuzzi’, has demonstrated a vulnerability in the Claude Code AI model where it can be manipulated through prompt injection via website summarization requests.

The attack involves asking the model to summarize a malicious website designed to look like a notebook record archive. By exploiting model behavior, the researcher induced the AI to use ‘curl’ instead of its standard ‘WebFetch’ tool to retrieve content. The site contained a malicious Python file named ‘struct.py’.

While the model initially refused to execute the file's decoder due to security rules, it attempted to bypass this by creating its own decoder using the ‘base64’ module. This allowed the attacker to exploit Python module shadowing, where a local file with the same name as a standard module overwrites the original. This resulted in the execution of the malicious file, which could lead to unauthorized actions such as accessing local files or opening applications.