Johann Rehberger chains an HTTP 415 nudge, a self-written decoder and a poisoned struct.py to get code execution past Claude Code Opus 5 Auto Mode

Embrace The Red (Johann Rehberger), via Simon Willison·high signalXBlueskyLinkedInCopy link

Rehberger's chain serves a 415 Unsupported Media Type to push Claude off WebFetch onto curl, delivers a zip whose bundled binary decoder Claude refuses, then relies on Claude writing its own Python decoder and running it inside the extracted directory, where importing base64 pulls in a malicious struct.py from the archive. Success ran 60% on the C2 callback chain and 60-80% on the subprocess-spawning variants over small samples, and in some runs Auto Mode blocked Claude's own cleanup command after it detected the compromise. Anthropic triaged the report as Informative, saying Auto Mode is a best-effort classifier rather than a security guarantee and that the real boundaries are OS isolation and network egress control.