AI Pulse · AI Trends Pulse

Claude Code’s Auto Mode is meant to make the coding assistant easier to use by approving routine actions without asking every time. Researcher Johann Rehberger showed that this convenience can create a real security gap. By asking Claude to summarise a website containing hidden instructions, he was able to hijack Auto Mode in 60 to 80 percent of test runs.

The chain matters. Claude’s WebFetch tool failed, so it fell back to running curl through Bash. That downloaded a ZIP file containing a planted struct.py file. When Python imported that file instead of its normal built-in version, the attacker’s code could run. In some tests, Auto Mode even prevented Claude from stopping the compromised process. Anthropic’s position is clear, Auto Mode is a convenience feature using a best-effort classifier, not a security guarantee. The technical detail is worth reading in the original report.

For an owner or operator, the lesson is simple. Don’t treat AI agents with shell access, file access, or credentials as harmless helpers just because they are working on a routine task. A webpage, document, support ticket, or downloaded file can carry instructions intended for the AI, not your staff. Keep agents in restricted environments, limit what they can download and execute, and make human approval mandatory for actions involving systems, data, or credentials. This is the kind of thing we build into an AI command centre, clear controls around what an agent can see, do, and approve.