Malicious Site Tricks Claude Auto Mode into Running Code

A researcher demonstrated that a seemingly harmless “summarize this website” request can be turned into a prompt-injection style attack that pushes Claude Code (Auto Mode) into running commands and ultimately executing attacker code. The workflow uses a fake archive site that forces a tool fallback to curl, delivers a booby-trapped ZIP, and abuses Python “module shadowing” so the agent’s own decoder code triggers the payload.

Key findings

• A malicious website workflow achieved reported 60–80% success in a small test sample by guiding an AI coding agent into unsafe tool use and code execution.
• The site intentionally causes WebFetch to fail with “415 Unsupported Media Type,” leading the agent to use shell + curl instead.
• The downloaded ZIP contains a poisoned Python file (struct.py) that gets imported indirectly when the agent runs its own decoder inside the extracted folder.
• The payload chain downloads and executes a remote stage, then runs a native payload and establishes a C2 callback in the lab demo.
• In some runs, Auto Mode allowed creating the malicious process but later blocked cleanup/termination commands.

Who’s being targeted

• Commonly targeted roles: Developers, AI/ML Engineering, Security Engineering, IT Operations, Security Awareness.
• Affected industries: Software development, IT engineering, AI/ML engineering.
• Attack channels: website.
• Impersonated: A legitimate-looking online archive/catalogue site, Catalogue decoder documentation inside README.txt, Python decoding/import process (module-level code execution during import).

Awareness takeaways

• Treat AI coding agents like untrusted automation: run them in a sandboxed environment with monitoring.
• Be cautious when an agent is nudged from safer tools to more dangerous ones (e.g., from a web fetcher to shell + curl).
• Don’t run scripts from inside downloaded/extracted folders; import/module shadowing can turn ‘your own code’ into the execution trigger.
• Lock down network egress and secrets exposure for agent runtimes to reduce impact if execution occurs.

Red flags to watch for

• Unexpected content-type failure nudges the toolchain into using curl/shell: “415 Unsupported Media Type”
• Content arrives as an executable workflow (ZIP with a decoder and Python modules) instead of simple web text
• Agent runs code from inside an attacker-controlled extracted directory (enabling import/module shadowing)
• ZIP contains a file named like a standard library module (e.g., “struct.py”)
• Agent executes Python from the extracted archive root (import path includes attacker files)
• Decoy executable encourages unsafe local decoding behavior even when it is refused
• Hidden network download occurs during what should be offline decoding/parsing
• Unexpected child processes (e.g., Python spawning Python) during a simple decode task
• Agent later realizes compromise but cannot remediate due to tool safety gating