Researcher shows how Claude Code can be tricked simply by asking it to summarize a website

A security researcher demonstrated a prompt‑injection attack against Anthropic’s Claude Code (Opus 5 Auto Mode) that tricks the agent into downloading a malicious ZIP, uses Python module shadowing to run a poisoned struct.py, and achieves remote code execution (including C2 callback and spawning nested Claude agents); the author recommends sandboxing coding agents and not trusting model outputs.