This post is also available in:
עברית (Hebrew)
AI coding agents are increasingly able to browse websites, download files, write programs and execute commands with limited human supervision. Those capabilities make them useful for long-running development tasks, but they also create a security problem: an agent does not necessarily need to receive an explicitly malicious instruction to be steered toward a dangerous action.
Security researcher Johann Rehberger demonstrated this problem against Claude Code’s Auto Mode, a feature designed to let the coding agent work autonomously while using a classifier to block actions considered destructive, irreversible or directed outside its environment. According to the researcher, his attack succeeded in some testing configurations up to 80% of the time.
The demonstration begins innocently: The system is asked to summarize a website containing what appears to be an archive of notebook records. When its normal web-retrieval method encounters an error, the agent independently chooses another route and follows a redirect that downloads a ZIP archive.
Inside are supposedly encoded records and a decoder. The system recognizes the supplied decoder as suspicious and refuses to execute it. Instead, it writes its own Python script to process the files, apparently avoiding the attack.
The trap is elsewhere.
According to Cyber News, the archive contains a malicious file called struct.py, matching the name of Python’s legitimate standard-library struct module. Under certain execution conditions, Python searches the current directory before loading the expected library. When the system runs its newly written decoder from the malicious archive’s directory, Python can therefore import the attacker’s struct.py instead of the genuine module.
The malicious code then executes without the system deliberately choosing to run it. The researcher demonstrated the compromise using code that contacted a command-and-control server.
The behavior was not completely consistent. In some runs, the system identified the danger before execution, launched Python in isolated mode or ran its decoder from a safer directory. That variability is why the reported success rate should not be interpreted as an unavoidable compromise.
Another unusual result appeared after successful execution. The system sometimes recognized that the malicious library had run and attempted to terminate the process, but Auto Mode blocked the cleanup command. In effect, the safety classifier could permit the action that triggered the malware while rejecting a later action intended to stop it.
The research has implications beyond coding assistants. Government, defense and critical-infrastructure organizations are increasingly considering autonomous AI agents for software development, cybersecurity and operational workflows. An agent with permission to download files and execute code can become a valuable target even when its safety system rejects overtly malicious commands.
The researcher disclosed the findings to Anthropic, which reportedly classified the report as “Informative”. His broader recommendation is that autonomous approval mechanisms should not replace sandboxing, isolation and monitoring.
The experiment illustrates a difficult problem in agentic AI security: attackers may not need to convince an AI to knowingly execute malware. They may only need to shape the environment so that the agent’s own reasonable decisions eventually lead it into the trap.
