Researcher shows how Claude Code can be tricked simply by asking it to summarize a website

Security researcher Johann Rehberger says he can hijack Anthropic’s Claude Code (Opus 5) in Auto Mode via prompt injection that leads to code execution by ~60%–80% success rate across tested variants. The exploit chains tool misuse (curl via Bash after WebFetch fails) plus Python module shadowing to run a poisoned struct.py, then triggers a remote command-and-control callback. Anthropic reportedly told him the behavior is “working as designed,” with the key mitigation being OS sandboxing and network egress control.

Analysis

The market is likely to misread this as a pure model-safety story, but the equity impact is really about workflow design. If autonomous code agents need external sandboxing, egress control, and file-system isolation to be deployable, then the spend migrates away from the model vendors and toward security layers that can sit between the agent and the environment. That is a structurally positive setup for endpoint, identity, network segmentation, and cloud workload security names; the negative is for any software vendor pitching "default-on autonomy" as a productivity unlock without adding a hard containment layer.

Near term, this should not move broad software multiples much unless it shows up in enterprise rollout pauses. The second-order risk is slower conversion from demos to production: buyer security teams will force more approvals, narrower permissions, and private network constraints, which elongates sales cycles by weeks to months and can compress near-term AI attach-rate assumptions. The bigger risk to the bullish AI narrative is not a ban, but a change in deployment architecture that makes each agent slightly less magical and more expensive to secure.

Contrarian takeaway: consensus is likely overestimating how fast "agentic" tools become default in enterprises, but also underestimating how quickly budgets shift once security teams get involved. This is more a budget reallocation than an AI demand death spiral. If public vendors can prove hardened sandboxing and policy enforcement, the thesis weakens; if repeated prompt-injection demos start appearing in mainstream security reviews over the next 1-3 months, expect procurement friction to persist into next earnings season.

Key Decisions for Investors

• Add on weakness to CYBER security proxies (CIBR or HACK) for a 1-3 month rotation trade; the catalyst is increased enterprise demand for AI sandboxing, egress control, and runtime isolation rather than a one-off headline.
• Overweight PANW and CRWD versus the broad software basket for the next 1-3 quarters; these are best positioned to monetize the "secure the agent" spend, with better odds of revenue carry than pure-play AI app vendors.
• Do not add to broad AI productivity SaaS exposure on this tape until we see evidence of hardened agent controls in enterprise rollouts; the risk/reward is worse if buyers require human-in-the-loop approvals and shrink usage intensity.
• Set a watch item on MSFT/GOOGL enterprise AI adoption commentary next earnings cycle: any mention of sandboxing, constrained permissions, or slower Copilot/Code Assist deployment would validate the thesis; absence of that language would falsify the concern.