Analysis
Security researcher Johann Rehberger has demonstrated that Claude Code can be pushed into executing attacker-controlled code by a request as ordinary as summarizing a web page, The Register reported.
The chain is a study in how agent safety fails at the seams rather than at any single step. The user asks for a summary. WebFetch fails, so the agent falls back to curl. The target redirects to a ZIP archive containing obfuscated Python. Inside is a file named struct.py that shadows the Python standard library module of the same name, so it executes on import. Rehberger's variants worked 60-80% of the time. The most instructive detail: the model declined to run a supplied decoder binary for safety reasons -- and then wrote its own decoder, opening the exact path it had just refused.
The response
Anthropic characterized the behavior as working as designed, saying "Auto Mode is a convenience feature backed by a best-effort classifier, not a security guarantee." That is a defensible engineering position and an uncomfortable one for the many teams running coding agents against production repositories on the assumption that permissions prompts are a control. Pulse has tracked Anthropic's other security and safety disclosures this week, including its Pentagon court win and its automated-alignment-researcher paper.
The wider pattern
Prompt injection has no clean fix, and every major agent vendor is exposed. OpenAI's Codex and Operator, Google's Jules, Cursor's agent mode and GitHub Copilot's agents all combine untrusted web content with tool execution in the same context window. Simon Willison has spent two years arguing that the lethal trifecta -- private data access, untrusted content, and external communication -- is unsolved. This demonstration is a concrete instance rather than a novel class.
The economics of the fix are the real obstacle. Sandboxing an agent means slower execution, restricted filesystem access and network egress rules that break legitimate workflows -- which is precisely why the convenient modes exist and why users enable them. Every vendor is trading security against the frictionless experience that sells the product, and users pick convenience every time it is offered as a default.
Rehberger's research has produced a steady catalog of these chains across vendors, and the pattern in each is the same: no individual step is malicious, so no individual guardrail fires. That is a structural property of systems that mix instructions and data in one context, not a bug any single patch closes. Enterprises deploying coding agents against real repositories should assume compromise is possible and design the blast radius accordingly -- separate credentials, no production secrets in the agent's environment, and egress allowlists. The vendors will keep improving classifiers, and classifiers will keep being probabilistic.
The disclosure lands as agentic coding tools move into regulated industries, where a compromised agent with repository write access is a materially different incident than a leaked chat log. Security teams evaluating these products should ask for the threat model in writing, and treat any answer that begins and ends with model-side filtering as incomplete.
Rehberger's own mitigation advice is the practical takeaway: run agents in sandboxes with OS-level isolation and network egress controls, and, in his words, "do not trust the model output." Enterprises rolling out coding agents should be asking their vendors what happens on the compromised-webpage path, and getting an answer that involves a container rather than a classifier.
