Security Researcher Bypasses Claude Code's Auto Mode Safety Guardrails
Security researcher Johann Rehberger successfully bypassed the safety guardrails of Anthropic's Claude Code "auto mode" by exploiting Python module shadowing. The exploit tricks the AI agent into downloading a zip archive and executing arbitrary code via a malicious local Python file. This vulnerability challenges Anthropic's safety claims regarding Claude Code's default execution mode, highlighting that AI agents require robust sandboxing rather than relying solely on built-in safety guardrails. Furthermore, the safety mechanism itself backfired by blocking Claude's attempts to terminate the malware process. The attack works about 80% of the time by extracting a malicious `struct.py` file from a zip archive, which is then executed when Claude Code imports the standard `base64` library. To mitigate such risks, researchers recommend running AI coding agents in isolated containers, restricting network egress, and withholding sensitive credentials.
## BACKGROUND
Claude Code is an agentic command-line tool developed by Anthropic that allows developers to delegate coding tasks directly from their terminal. Python module shadowing is a vulnerability where a locally defined Python file shares the same name as a standard library module, causing Python to load the local file first when that module (or another module depending on it) is imported.