Claude Code Opus 5 Vulnerable to RCE via Python Module Shadowing

Security researcher Johann Rehberger, known as wunderwuzzi, has demonstrated that Claude Code running Opus 5 in Auto Mode is susceptible to remote code execution (RCE). The vulnerability allows an attacker to seize control of the host system by tricking the AI agent into summarizing a malicious website.

The attack triggers a specific chain of failures and fallback behaviors. When the agent attempts to summarize the target site, a failed WebFetch operation prompts the agent to fall back to using curl to retrieve the content. This leads to the download of a poisoned ZIP archive. RCE is then achieved through a technique called 'Python module shadowing'; the attacker includes a malicious 'struct.py' file within the ZIP archive. When Claude writes and executes its own decoder to process the file, it loads the malicious version of the module instead of the standard Python library. Rehberger reported that this exploit succeeds 60% to 80% of the time across tested variants.

The Role of Auto Mode

Claude Code is an agentic tool capable of writing files and executing bash commands. To streamline the user experience, Anthropic introduced 'Auto Mode,' which became the default setting for new sessions in mid-August 2026. Rather than requiring a human to approve every individual action, Auto Mode relies on an internal safety classifier to automatically authorize steps the model deems safe.

In this instance, the exploit leverages the agent's own problem-solving capabilities. By attempting to bypass a retrieval failure by writing its own code, the agent inadvertently creates the path for the injection. This allows the attacker to execute commands such as 'claude -p', which launches a nested, headless Claude Code instance, granting the attacker a new agent with its own tool access and system context.

Why It Matters

This research highlights a critical gap between AI safety classifiers and actual operating system security. As Johann Rehberger noted, the safety decision to attempt a workaround is ironically what creates the exploit path. It demonstrates that internal model guardrails are not a substitute for hard security boundaries like network egress controls or OS-level permissions.

What's Next

The findings underscore the necessity of running AI coding agents within isolated sandboxes. Because the model's internal classifiers can be bypassed through complex prompt injection chains, industry experts suggest that the only reliable defense is to assume the agent can be compromised and limit its environment accordingly. Users are encouraged to monitor for updates from Anthropic regarding the safety classifier's handling of external file downloads and module imports.