The payload itself is not the notable part. What matters is that every step in the chain is a step you would want a competent agent to take. WebFetch returns 415, so try curl [3]. The server sends a 303, so follow it [4]. There is an archive, so unpack it [4]. There is an unsigned macOS binary in there, so refuse to run it [5]. Blocked, but the job is still to decode seven records, so write a decoder [5]. A decoder needs base64, and base64 imports struct, and Python checks the working directory first [6]. Module shadowing is decades old and has nothing to do with models [6].
Teams generally assume the classifier's job is to catch bad instructions in untrusted text. In Auto Mode, its actual job is harder: evaluate a sequence in which no single action is bad, and refuse it anyway. Rehberger's own reading is that the classifier was never built for chains assembled out of individually harmless steps [9]. Anthropic's answer to him was that Auto Mode is a convenience feature backed by a best-effort classifier and not a security guarantee [8], and that the behaviour is working as designed [8]. Those two statements are consistent, and together they amount to a handoff: the person catching it is whoever installed the thing.
The numbers deserve a careful read. Three variants, five runs each, is fifteen attempts, and the range was 60% to 80% [10]. That is not a measured probability of compromise for your repo; Rehberger himself calls the results representative of a motivated attack but not comprehensive [11]. The number that matters for planning is the low end, because 60% of a small sample already means a determined attacker gets there on the second or third try, and retrying is free.
The variant worth staring at is the second one, where struct.py launches a fresh headless session with `claude -p` [12]. The child agent gets its own tool access and its own context [13], and in Rehberger's runs it ran whoami, uname and id, opened Calculator, and wrote files into the home directory [14]. Approval-based defences assume one agent, one conversation, one human watching the transcript. A spawned sibling is outside the frame nobody is reading.
Two questions worth forcing on Monday. First: when a preferred tool fails, does your agent get to substitute a shell? If yes, your fetch policy is your shell policy, and you should write it down that way. Second: if a spawned process gets full tool access, what does it reach? Rehberger's position is that the real boundary is operating system isolation and network egress control, and that coding agents belong in a sandbox [15]. That is a smaller ask than a model fix and it does not require Anthropic to agree with you, which matters, because as of this reporting the company has not addressed the finding publicly [16] and did not respond to The Register's request for comment [16].
Auto Mode has been the default since mid-August [2], and it is the setting that lets Claude Code pick tools and run them without asking [17]. Every decision in the chain was defensible, even though nobody approved the chain as a whole [18].
