Johann Rehberger showed that Anthropic’s Claude Code Opus 5 in Auto Mode can be steered from a simple request to summarize a website into Bash commands that fetch attacker-controlled content. He said the attack worked in up to 80 percent of his runs, and Auto Mode is now the default setting.
The page plants instructions that push Claude away from its WebFetch tool and into curl, which then follows a redirect to a ZIP archive. From there the model’s own safety choice to avoid a supplied decoder becomes the path into Python code that can download and run a remote payload, so the issue is not just text manipulation but tool use.
For teams that let an agent read web pages and reach a shell, the exposure sits at the host and network boundary: if the assistant can call system tools and reach outbound traffic, a summary request can become code execution. Prompt hygiene alone does not close that gap.