A Researcher Hijacked Claude Code by Asking it to Summarise a Web Page
A security researcher, Johann Rehberger (known as wunderwuzzi), successfully exploited Claude Code, an AI agent, by asking it to summarise a web page. In up to 80% of his attempts, the model executed an attacker’s code on his machine.
September 1, 2026 – 4:14 pm
Credit: Daniil Komov on Pexels
Asking Claude Code to summarise a web page can inadvertently lead to the execution of malicious code. This was demonstrated by Jessica Lyons in her report for The Register.
Rehberger’s exploit chain began with a seemingly innocuous website claiming to be an archive of notebook records. The agent, however, attempted to perform actions based on the site’s content:
- Claude tried to read the page using WebFetch but encountered a "415 Unsupported Media Type" error.
- It then attempted a Bash call with
curl(a tool it prefers) when the first attempt failed. - The website redirected to a ZIP archive containing catalog metadata, a README, encoded notebook records, a macOS decoder binary, and a Python file called
struct.py.
The key to Rehberger’s success was his ability to manipulate Claude’s safety guardrails. While the model is trained to refuse running certain binaries (like the supplied decoder), it created its own version of the decoder using tools readily available on the system. This process, known as shadowing, allows malicious code to bypass security measures by hijacking legitimate modules.
Rehberger used ChatGPT to obfuscate the malicious file, making it appear benign to Claude’s safety checks. Once executed, the file launched a separate Python process that downloaded a remote payload and contacted a command-and-control server. This payload allowed for arbitrary code execution, including starting a new instance of Claude Code (a "nested Claude").
Rehberger tested his exploit successfully five times each for three different variations, achieving between 60% and 80% success rates. He emphasizes that these results represent a motivated attack, not comprehensive coverage:
“I would say that these results are representative for a motivated attack, but not comprehensive.”
Anthropic’s Response:
Rehberger reported the exploit chain to Anthropic, the company behind Claude Code. They confirmed that the behaviour was "working as designed". They further stated: "Auto Mode is a convenience feature backed by a best-effort classifier, not a security guarantee."
Rehberger’s advice:
He suggests improving safety measures through:
- Sandboxing: Run coding agents in isolated environments.
- Enhanced Isolation: Implement stronger operating system isolation and network egress control.
- Caution: “Do not trust the model output.”