# Claude Code Auto Mode - Prompt Injection Download-and-Execute Cradle

- **Severity:** Critical
- **Signature ID:** `e4a2f6d8-9c3b-4a1e-8f7d-2b6c5a9e3d10`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

An attacker hides instructions inside a webpage that Claude Code is asked to summarize. Those hidden instructions trick the AI agent's safety approval step into letting it run a command that downloads and executes attacker-controlled code, without a human ever approving the action.

## How the attack works

A user asks Claude Code (running in Auto Mode) to summarize a website. The page contains hidden text crafted as a prompt injection, aimed at the agent's own safety classifier rather than the human user. The injected instructions cause the agent to auto-approve spawning a process that fetches remote code, typically via curl or wget piped to a shell, a base64 or PowerShell-encoded command, or a scripting interpreter that downloads and executes content directly. The result is code execution on the machine running Claude Code with no human approval step in between.

## Why it matters

An attacker who controls or poisons web content that an AI agent summarizes can achieve arbitrary code execution on the host running the agent, skipping the human-in-the-loop safeguard that is supposed to catch risky actions.

## What you can do

- Require explicit human confirmation for any process Claude Code spawns that involves network downloads followed by execution, even if the agent's own classifier auto-approved it.
- Restrict or sandbox the environment Claude Code runs in so downloaded scripts cannot reach sensitive systems or credentials.
- Log and review the specific web content an agent was asked to summarize whenever it is followed by a download-and-execute action, to check for injected instructions.
- Treat curl/wget-to-shell, base64-encoded command execution, and script-fetches-and-execs patterns from an AI agent process as high-risk regardless of stated justification, and verify they were user-initiated, not content-triggered.

## Known benign look-alikes

- A developer explicitly instructs Claude Code to run an official vendor install script that follows the curl-pipe-to-shell convention (e.g. rustup, nvm, Homebrew installers) during a normal coding session.
- CI or regression test harnesses that intentionally invoke download-and-execute or base64-decode-and-execute syntax to validate this detection rule or a sandboxed fixture, rather than to perform a real attack.
- Legitimate use of PowerShell -EncodedCommand or base64-encoded payloads for approved deployment or configuration automation unrelated to any web content the agent was asked to summarize.

---
Source: https://www.netzilo.com/threats/claude-auto-mode-injection-exec-cradle