Cybersecurity researcher Johann Rehberger, operating under the moniker wunderwuzzi and founder of Embrace The Red, has revealed a serious vulnerability in Anthropic's terminal agent Claude Code. The flaw specifically affects the newly standardized Auto Mode running on Claude Opus 5. The researcher constructed a successful exploit chain capable of executing arbitrary code directly on local developer machines.
The attack vector relies on an indirect prompt injection embedded within a seemingly benign website. When the autonomous agent parses the untrusted web content during regular workflows, it unknowingly absorbs concealed attacker instructions. These hidden commands force the agent to download a manipulated ZIP archive from a remote location and extract its contents into the current workspace.
To achieve remote code execution, the exploit employs a technique known as Python Module Shadowing. The downloaded archive contains a rogue script named struct.py, which shadows a standard component of the Python core library. When the agent or an associated process subsequently imports the standard module, the malicious payload runs automatically in the background without prompting for user confirmation.
During controlled testing, the exploit chain achieved an alarming success rate between 60 and 80 percent. This high degree of reliability demonstrates that autonomous agents processing external data can be systematically manipulated into compromising local host environments. The experiment highlights that built-in model safety classifiers alone cannot replace hard boundaries at the system level.
The findings underscore the mounting operational hazards associated with autonomous coding tools granted broad terminal and file access. As software workflows move toward end-to-end automation, local development environments become prime targets for web-delivered exploits. Security teams must enforce strict containerization and operating system sandboxing rather than relying on the model's internal guardrails.