What gets me is not that Claude Code can be tricked. Of course it can. What’s unsettling is the particular shape of the trick: a refusal to run a binary, which sounds like the right instinct, turns into the moment the agent decides to improvise a decoder and walks straight into a module-shadowing trap. That’s the part I’d actually want to reproduce in a sandbox, because it feels like the kind of failure that keeps happening in agents: the model doesn’t do one obviously dumb thing, it does six reasonable things in a row and the chain only becomes visible once the machine is already doing the attacker’s job.
The “working as designed” response from Anthropic is the part I’m least surprised by and also the most revealing. If Auto Mode is really just a convenience layer backed by a best-effort classifier, then calling it a safety boundary was always a bit optimistic. The article is basically arguing that the real boundary is the OS, the sandbox, and network controls. I think that’s right, or at least closer to right than pretending a classifier can reliably notice a multi-step prompt injection assembled out of harmless-looking pieces. If you’re building with Claude Code, the uncomfortable lesson is that you should stop treating the model as the thing that keeps you safe. It won’t.
There’s also a more annoying practical point hiding in here: the attack doesn’t rely on one magical payload. It leans on ordinary developer behavior. Curl. Zip files. Python imports. A local struct.py shadowing the standard library is not novel, which is exactly why it works. That’s what makes the whole thing feel less like a one-off stunt and more like a template. If I were using Claude Code in anger, I’d want hard outbound controls, a locked-down filesystem, and probably no trust whatsoever in anything fetched from the web unless the agent is fenced in so tightly it can’t do much with it.
The nested-agent angle is even weirder. Spawning a fresh headless Claude session from inside the first one sounds like a recursive joke until you remember that the child gets its own context and tools. That’s not just code execution; that’s agent multiplication. I don’t know how far this generalizes, but it raises a nasty question for any tool-using model: if the model can launch another instance of itself, what exactly is the security model supposed to be? The answer can’t be “hope the classifier catches it.”
And then there’s the timing. Anthropic is already getting heat over Claude Code limits and usage expectations, and now this lands too. Separate issues, sure, but they combine badly in the public mind: one week the product feels throttled, the next week it looks porous. That doesn’t mean the security finding is unfair. It just means the company’s messaging is doing it no favors. For people building on top of Claude, the takeaway I’d actually trust is simpler than the marketing language around “most aligned” models: if an agent can browse, unpack, script, and execute, assume a hostile page can steer it unless you’ve taken that power away.
Reference: Claude Code can be hijacked by a web page
