A researcher hijacked Claude Code by asking it to summarise a web page

A security researcher achieved up to 80% success exploiting Claude Code via prompt injection, tricking the AI agent into writing its own malicious decoder after refusing a supplied binary — ironically making its safety refusal the attack vector. Using module shadowing, the payload executed arbitrary code and phoned home to a C2 server. Anthropic told the researcher the behavior is working as designed.