Full Report
More prompt-injection hijinks from wunderwuzzi
Analysis Summary
# Vulnerability: Remote Code Execution via Prompt Injection and Module Shadowing in Claude Code
## CVE Details
- **CVE ID**: Not Assigned (Anthropic designates this as "working as designed")
- **CVSS Score**: N/A (Estimated High/Critical based on RCE impact)
- **CWE**: CWE-506 (Embedded Malicious Code), CWE-94 (Code Injection), CWE-427 (Uncontrolled Search Path Element)
## Affected Systems
- **Products**: Anthropic Claude Code (Agentic Coding Tool)
- **Versions**: Versions utilizing Opus 5 (as of mid-August 2026)
- **Configurations**: "Auto Mode" enabled (default setting); Tool access to Bash/Terminal permitted.
## Vulnerability Description
The vulnerability is a multi-stage prompt injection and logic flaw that bypasses Claude's safety guardrails. When Claude Code is tasked with summarizing a malicious website, the attacker forces a fallback from the secure `WebFetch` tool to a raw `curl` command via a 415 error.
The attack then leverages a "Double-Whammy" technique:
1. **Redirect/Download**: The site redirects to a malicious ZIP archive containing a poisoned Python file named `struct.py`.
2. **Safety Logic Reversal**: Claude refuses to run a supplied binary for security reasons and instead chooses to write its own Python decoder.
3. **Python Module Shadowing**: The attacker’s `struct.py` shares a name with a Python standard library module. When Claude's generated script imports the legitimate `base64` module, that module in turn imports `struct`. Python loads the local malicious `struct.py` instead of the system library.
4. **Obfuscation**: The malicious code is obfuscated to bypass LLM safety filters, eventually executing a remote payload or spawning a nested agent.
## Exploitation
- **Status**: PoC available (demonstrated by Johann Rehberger/wunderwuzzi)
- **Complexity**: Medium (Requires orchestrating specific HTTP responses and file naming)
- **Attack Vector**: Network (Triggered by visiting/summarizing a malicious URL)
## Impact
- **Confidentiality**: High (Attacker can perform system reconnaissance and exfiltrate files)
- **Integrity**: High (Attacker can execute arbitrary commands and modify local files)
- **Availability**: High (Potential for system takeover or spawning persistent malicious agents)
## Remediation
### Patches
- **No official patch**: Anthropic stated the behavior is "working as designed" and categorized "Auto Mode" as a convenience feature rather than a security boundary.
### Workarounds
- **Sandboxing**: Run Claude Code and similar agentic tools only within isolated environments (containers/VMs) with restricted permissions.
- **Egress Filtering**: Implement strict network egress controls to prevent the agent from reaching unknown or malicious domains.
- **Manual Oversight**: Avoid using "Auto Mode" for tasks involving untrusted external data or websites.
## Detection
- **Indicators of Compromise**:
- Unexpected `curl` commands in tool-use logs.
- Creation of local Python files with names matching standard libraries (e.g., `struct.py`, `os.py`, `sys.py`).
- Outbound connections to unknown IPs/domains following a web summary task.
- **Detection methods**: Monitor terminal history and file system changes in the directory where Claude Code is active.
## References
- **Researcher Blog**: hxxps[://]embracethered[.]com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/
- **Video Demo**: hxxps[://]youtu[.]be/18PIeJoxYtc?si=1g-E31JGHQKDn0Ox
- **Technical Context**: hxxps[://]stackoverflow[.]com/questions/491705/python-problem-with-local-modules-shadowing-global-modules