A Simple Website Summary Just Exposed the Limits of AI Coding Guardrails

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

Ask an AI coding assistant to summarize a webpage, and you’d expect a summary back. Nothing more. That basic assumption just took a hit, and it says something important about where AI agent security actually stands going into the fall. Security researcher Johann Rehberger, who publishes under the handle wunderwuzzi at Embrace The Red, found a way to hijack Claude Code running in Opus 5’s Auto Mode using nothing more exotic than a request to summarize a website. No malicious attachment from the user. No obvious red flag in the prompt. Just a normal-looking task that an agent handles a hundred times a day. Auto Mode became the default way Claude Code runs in mid-August. Instead of stopping to ask permission before every command, it leans on a safety classifier to decide what’s fine to execute on its own. That’s the whole pitch: less friction, more autonomy, an agent that gets on with the work instead of pinging you for approval every few seconds. Here’s how the attack played out. Claude tried to fetch the target site using its WebFetch tool and received an HTTP 415 (Unsupported Media Type) error. So it fell back to curl instead, a reasonable move for any developer or agent. Curl pulled down a ZIP file the site presented as an archive of notebook records, complete with believable metadata. Inside sat a poisoned file named struct.py, built to shadow Python’s own standard library module of the same name. Claude did one thing right here. It refused to run a binary decoder bundled in the archive, because executing an unknown binary is an obvious risk. So it wrote its own decoder …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://devops.com/a-simple-website-summary-just-exposed-the-limits-of-ai-coding-guardrails/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.