A researcher reproduces the same failure live against Claude Code

Rehberger's chain starts with an ordinary request to summarize a webpage, moves Claude from its WebFetch tool to a direct curl download of a ZIP archive, and uses Python module shadowing to run remote code after Claude, having correctly refused to execute a suspicious binary, writes its own decoder and runs it from inside the compromised directory. Across small test samples the chain reached a 60 to 80 percent attack success rate against Claude Code Opus 5 in Auto Mode. In several runs, the same safety classifier that allowed the malicious process to start then denied Claude's own command to kill it once it recognized the compromise. Anthropic closed Rehberger's report as "Informative," telling him Auto Mode is a best-effort convenience feature, not a security guarantee, a position at odds with the company's own published benchmark showing a 0 percent attack success rate for Auto Mode on a fixed set of 72 scenarios that did not include this chain.

Why it matters: A published 0 percent figure and a working exploit can both be true if the exploit was never in the test set. An Auto Mode approval is a convenience signal; it does not prove the underlying action was safe.