A researcher found he could hijack Claude Code and run his own commands on a target machine just by getting the tool to summarize a web page.
Security researcher Johann Rehberger, who publishes under the handle wunderwuzzi, tested the attack against Claude Code and pulled it off in up to 80% of his attempts. The trick relies on prompt injection: instructions buried in a web page's content get read by the tool as though they came from the user, and the model follows them. Because Claude Code can execute code and run shell commands on the machine it operates on, a successful injection hands an attacker a foothold on that system. The finding surfaced Friday.
This is the core problem with letting AI agents read the open web and then act on what they read: any text on any page becomes a potential command. An 80% hit rate is uncomfortably high for a class of bug that has dogged AI browsing and agent tools for years without a durable fix.
Summarizing a webpage should not require trusting every word on it - which is exactly why 'just ask the AI to check this link' remains bad advice.