Claude Code Auto Mode Install Auto Malware

Claude Code on Auto Mode can automatically install malware despite its strong security system.

According to a report by the Cyber News website, cybersecurity researchers like Johann Rehberger, also known as "wunderwuzzi," conducted a test to disprove Anthropic's claim that the new Claude Code has a highly secure Auto Mode, and that it comes with a strong Prompt Injection system that cannot rely on the ability of these tools and protective features alone without another shield, such as the Isolated Environment. In that test, researchers confirmed that the Claude Code hack This strength is not difficult to achieve. One of the methods is to order Claude Code to summarize the Website Summary. It is possible to attack with RCE or Remote Code Execution, with a 80% chance of success, even though Anthropic, the developer of Claude Code, has a 0.00% chance of success.

In that experiment, the researchers created a website, which claimed to be a repository of Notebook records in a compressed file format. The zip inside has created data such as Metadata, file creation dates, Checksum data that looks realistic and reliable in the eyes of Claude Code. The researchers then instructed Claude Code to summarize the website (Website Summary). Claude took steps, starting with the WebFetch tool to retrieve the website, but the researchers set a trap by giving the website a response with a pseudo-error alert of "415 Unsupported Media Type."

After the above method failed, Claude followed the sequence by using the curl command to extract the data instead. The website responded with the status code (Status) HTTP 303 "See others." This code would lead to a change of the loading target to another URL, leading to the download of a Zip file containing the malware file (Payload) that the researcher put in for testing. After the Zip file was downloaded, Claude Code unlocked the file, but refused to run a decoding tool that the AI thought was Payload, which Claude was correct because in the file. Zip is an encoded forged file with a decode tool. In this step, instead of Claude Code, it will run them immediately. The AI starts the target file decoding tool in Python, which requires the associated library to be run.

And this caused the Claude Code to eventually overlap the plan, because the real Payload file is not in the decoding tool, but inside the file struct.py, which is a smooth file with the name of the Python standard library used for data conversion. And since the tool was created in Python, when running the library, it will always search and run from the current folder. After the decoding tool is written, the tool will search and retrieve the fake library file hidden in the decoded Zip file, leading to the installation of malware on the machine. The researchers concluded that Claude Code is actually very vulnerable to social engineering.

Even worse, the Claude Code was tested on Auto Mode, which Anthropic boasted was extremely safe, but Auto Mode tried to thwart Claude Code's attempts to correct the situation by closing down the dangerous process by denying Claude Code the cleanup order itself, which instead of protecting the machine from harm, bought time for hackers and malware to harm the machine for longer and longer than before.

The researchers have reported what happened to Anthropic, but Anthropic closed the case with an Informative status or an Informative status, but did not issue any editing patches. Therefore, Claude Code users are extremely cautious in their use.

# Trending # lemon 8 diary # ai # claudecode # freedomhack