Ask Claude Code to summarise a web page, and it can end up running an attacker’s code on your machine. A security researcher got that result in up to 80% of his attempts.
Jessica Lyons reported the finding for The Register on Friday. The work is by Johann Rehberger, who publishes as wunderwuzzi and has spent years pulling apart AI agents. He set the chain out on his own blog, with a video. It targets Opus 5 running in Auto Mode. Auto Mode has been the default since mid-August.
The chain starts with a website dressed up as an archive of notebook records. Everything after that, the agent does to itself.
The safety guardrail is the exploit
Claude tries to read the page with WebFetch. The server answers 415 Unsupported Media Type, so the agent reaches for a Bash call with curl instead. Rehberger never tells it to do that. He just makes the tool it prefers fail.
