Claude Code can be tricked into running malicious code by summarizing a website

A seemingly harmless request to summarize a website can be enough to trick Anthropic’s Claude Code into downloading and executing malicious code, according to security researcher Johann Rehberger.

The demonstration targets Claude Code running Claude Opus 5 in its default Auto Mode. Rehberger, known online as “wunderwuzzi,” found that a malicious website could embed hidden instructions designed to manipulate the coding agent into taking actions the user never explicitly requested.

The attack is a fresh example of the growing problem of “indirect prompt injection”, where an attacker does not need to directly control a user's prompt. Instead, malicious instructions are planted inside content that an AI agent is asked to read.

It Starts With a Simple Summary Request

The setup is deceptively ordinary. A user asks Claude Code to summarize a website. When Claude accesses the page, however, it encounters attacker-controlled instructions hidden within the site's content.

According to Rehberger's demonstration, the injected instructions can steer Claude through a chain of actions. When Claude's initial attempt to retrieve content fails, the malicious instructions persuade it to use Bash and `curl` to download a ZIP file.

The downloaded archive then contains a malicious Python file that can be loaded when Claude attempts to process the contents. The technique effectively turns the AI coding assistant's own workflow into part of the attack.

The Bigger Problem With AI Coding Agents

The latest demonstration does not mean that every Claude Code session can be hijacked simply by visiting a website. It does, however, highlight a fundamental security problem for AI agents: The line between data and instructions can be surprisingly easy to blur.

Traditional software attacks generally required an attacker to exploit a vulnerability in code or obtain access to a system. AI agents introduce another layer: They can be persuaded to attack themselves.

Claude Code can read files, access websites, execute commands and work with development environments. That makes prompt injection particularly dangerous because an attacker can potentially turn trusted content into instructions for an agent that already has significant privileges.