Claude Code Auto Mode was hijacked through a malicious ZIP archive
The author reports that a website-summary task led Claude Code Opus 5 in Auto Mode to download and extract a malicious ZIP archive. Claude declined to run the supplied binary but wrote and executed its own Python decoder inside the extracted directory, allowing a malicious struct.py file to shadow the standard library and trigger further payload execution. In the author’s lab tests, this resulted in visible Calculator launches and controlled C2 callbacks, with claimed attack success rates of up to 80% from a small sample. Some runs detected the compromise only after execution, and Auto Mode reportedly blocked attempted cleanup commands.
Why this is unexpected
Claude did not intentionally execute the malicious file; its attempt to avoid the supplied binary and write a decoder created the execution path instead. The safety classifier also reportedly allowed the payload to run but blocked some later cleanup attempts.