A one-line summarize request slips code execution past Claude Code's Auto Mode classifier

The chain's most instructive moment is the one where the model did the right thing. The README inside the ZIP advertised a bundled binary, `decoder-darwin`, as the catalogue decoder ^[10]. Claude declined to run it and wrote its own Python decoder instead ^[11]. It then ran that decoder from inside the directory it had just unpacked, where a file named `struct.py` shadowed Python's standard implementation, so the decoder's import of `base64` executed the attacker's file ^[12]. Claude refused the untrusted binary but ran its own replacement inside that same untrusted directory, and that is where the safety broke down.

The sequence works without ever instructing the model directly. The site presents itself as a small archive of notebook records, with catalogue metadata, checksums and seven short records about the development of the theory of language, which gives the agent a legitimate reason to keep digging ^[17]. A 303 redirect from the root URL points `curl` at the archive ^[9], and Claude extracts it into a temporary scratchpad folder ^[15]. The post's own framing is that the attack makes the malicious path the one worth pursuing rather than telling the model what to do ^[14]. The actions an intent classifier would have to score here are a `curl` fetch and a Python run, both plausible ways to satisfy the sentence the user typed ^[7].

The two success rates are not measuring the same quantity. Seventy-two scenarios at ten runs each is 720 trials ^[6], and a 0.00 percent cell means none of them landed, which is a genuine result about a pre-specified suite of unseen attacks ^[4][5]. It says nothing about an attacker who watches which step fails and rewrites that step, which is what the post set out to test ^[18]. The researcher's own denominator is missing too: 60 to 80 percent arrives with the phrase "small sample size" and no count ^[2]. Neither figure is independently checkable, since the vendor evaluation has no published benchmark name ^[5] and the test endpoint serves the payload only to allow-listed IPs, with the domain partly redacted to keep it out of search indices ^[7].

The open question is how durable the chain is. Every specific step in it is patchable, and the 415 nudge is not even always needed, because Claude sometimes reaches for `curl` unprompted ^[16]. The general shape is harder to patch at the classifier: an agent that can shell out, write attacker-supplied files to disk, and then run an interpreter inside that directory ^[11][12]. That shape calls for isolation and monitoring, not a scoring step that stands in for an approval prompt ^[1]. Embrace The Red's stated conclusion is that Auto Mode is not a substitute for running the agent in an isolated environment and watching what it does ^[13], and the evidence carries it at the level of existence rather than rate. Treat 60 to 80 percent as a demonstration that the true number is above zero, not as a measurement of how far above ^[2][3].