Researcher shows how Claude Code can be tricked simply by asking it to summarize a website

Anthropic’s Claude Code running Opus 5 in Auto Mode can be tricked into executing attacker-controlled code simply by asking the coding agent to summarize a website. The attack works up to 80 percent of the time, according to prompt-injection wizard Johann Rehberger, aka wunderwuzzi. In a blog and video demo, he detailed how to hijack Opus 5 in Auto Mode, which is the default setting for Claude as of mid-August.