Asking Claude Code to summarise a page can hand over your machine.
Security researcher Johann Rehberger published a web page that makes Claude Code run an attacker's program. Anthropic had advertised a zero percent success rate for such injections, and his attack worked 60 to 80 percent of the time. Anthropic closed the report as informative and called Auto Mode a filter, not a security boundary.
Why it mattersAny agent that reads the open web can take instructions from what it reads. Sandbox the machine, because the model's own judgement is not the wall.
Read in the app — free, in 9 languages
Related stories
Anthropic is asking lawyers how its deal-making agents should behave.2026-10-18A breach at coding agent OpenCode exposed users' saved AI keys.
2026-10-18DeepSeek quietly made its cheap open model a far better coder.
2026-10-17Nvidia squeezed an agent model into a gaming card's 24GB of memory.
2026-10-17AI bug hunting helped push the Postgres 19 database to November.
2026-10-17