Claude Code Auto Mode - Prompt Injection Download-and-Execute Cradle
An attacker hides instructions inside a webpage that Claude Code is asked to summarize. Those hidden instructions trick the AI agent's safety approval step into letting it run a command that downloads and executes attacker-controlled code, without a human ever approving the action.
How the attack works
A user asks Claude Code (running in Auto Mode) to summarize a website. The page contains hidden text crafted as a prompt injection, aimed at the agent's own safety classifier rather than the human user. The injected instructions cause the agent to auto-approve spawning a process that fetches remote code, typically via curl or wget piped to a shell, a base64 or PowerShell-encoded command, or a scripting interpreter that downloads and executes content directly. The result is code execution on the machine running Claude Code with no human approval step in between.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- e4a2f6d8-9c3b-4a1e-8f7d-2b6c5a9e3d10
- Severity
- Critical
Why it matters
An attacker who controls or poisons web content that an AI agent summarizes can achieve arbitrary code execution on the host running the agent, skipping the human-in-the-loop safeguard that is supposed to catch risky actions.
What you can do
- →Require explicit human confirmation for any process Claude Code spawns that involves network downloads followed by execution, even if the agent's own classifier auto-approved it.
- →Restrict or sandbox the environment Claude Code runs in so downloaded scripts cannot reach sensitive systems or credentials.
- →Log and review the specific web content an agent was asked to summarize whenever it is followed by a download-and-execute action, to check for injected instructions.
- →Treat curl/wget-to-shell, base64-encoded command execution, and script-fetches-and-execs patterns from an AI agent process as high-risk regardless of stated justification, and verify they were user-initiated, not content-triggered.
Known benign look-alikes
- A developer explicitly instructs Claude Code to run an official vendor install script that follows the curl-pipe-to-shell convention (e.g. rustup, nvm, Homebrew installers) during a normal coding session.
- CI or regression test harnesses that intentionally invoke download-and-execute or base64-decode-and-execute syntax to validate this detection rule or a sandboxed fixture, rather than to perform a real attack.
- Legitimate use of PowerShell -EncodedCommand or base64-encoded payloads for approved deployment or configuration automation unrelated to any web content the agent was asked to summarize.