Claude Code Opus 5 Vulnerability Allows Code Execution via Prompt Injection

• •Claude Code Opus 5 can be exploited via prompt injection with 60-80% success rates.
• •The attack involves tricking the AI into using curl to download a malicious ZIP archive.
• •Safety mechanisms in Claude Code are bypassed through Python module shadowing.

Research has revealed that Claude Code Opus 5 in Auto Mode can be exploited to execute malicious code through a simple website summary request. Security researcher Johann Rehberger demonstrated that the attack succeeds 60-80% of the time. The method involves tricking Claude into using curl instead of its WebFetch tool to access a malicious ZIP archive. This archive contains a poisoned Python file, struct.py, which can execute arbitrary code. The exploit takes advantage of Python module shadowing, allowing the malicious file to override legitimate modules. Despite safety measures, the AI's decision-making process leads to successful code execution. This vulnerability raises concerns about the effectiveness of current safety mechanisms in AI models. The attack chain has been tested in a limited lab environment, and further investigation is needed to assess its broader implications.