The agent refused the dangerous program, then wrote its own way into the trap

Johann Rehberger’s test began with an archive containing something the agent wanted to read. Claude rejected the supplied executable and wrote its own decoder instead. That sounds like the safer choice.

The replacement still ran in an environment the attacker had prepared. Python’s import behavior caused it to load a malicious local module while importing ordinary library code. The agent had inspected the obvious danger and missed the surrounding execution context.

In some runs, Auto Mode subsequently blocked the command Claude wanted to use to stop the malicious process. Approval of the initial action and rejection of the cleanup combined into a worse outcome.

The researcher reports small batches with success in three or four of five runs. These are demonstrations of a failure mode, not a population-wide estimate that 80% of Claude Code sessions are vulnerable.

Simon later corrected the classification: the model was not simply obeying hostile instructions embedded in a page. This was an environment-confusion attack. That distinction matters because better instruction filtering alone would not remove the underlying problem.

The defensive lesson concerns execution boundaries. An agent’s judgment and an action classifier are additional controls; neither makes downloaded code or a working directory trustworthy. Isolating the runtime, limiting its network access and keeping valuable credentials outside it reduce what a bad decision can reach.