Web Pages Are Talking Back: The Prompt-Injection Path Into Agentic Code Execution

What looks like a simple productivity feature can become a trust-boundary problem in seconds. In this case, the danger is not a model “misunderstanding” a prompt in the usual sense. It is an agent reading hostile web content, treating it as part of the workflow, and then crossing from analysis into action. That is the point where prompt injection stops being an abstract AI safety term and starts looking like a practical security control failure.

Fast Facts

• The demonstration centers on Claude Code Opus 5 running in default Auto Mode.
• The entry point is a website-summary task, not a direct command to run code.
• Attacker-controlled content on a malicious website steers the agent’s behavior.
• The reported end state is attacker-controlled code execution.
• The case highlights indirect prompt injection as a risk for tool-using AI agents.

Why the attack works

Prompt injection is best understood as untrusted content behaving like a hidden instruction channel. OWASP treats indirect prompt injection as especially dangerous because the model processes attacker text inside a document, page, or message it was supposed to summarize or analyze. The user thinks they are feeding the agent data. The attacker is trying to feed it a workflow.

That distinction matters in agentic systems. A text-only chatbot may generate a bad answer. A coding agent with tool access can take the next step, and that next step can have real effects. If the agent can fetch pages, run shell commands, write files, or invoke local tooling, then a poisoned document can become a path toward code execution or other sensitive actions, depending on local permissions.

Anthropic’s Auto Mode documentation frames this kind of control as risk reduction, not a hard security boundary. That is the core lesson here: approval logic can slow down obvious abuse, but it does not automatically stop a multi-step social-engineering path that looks locally reasonable at each stage. In other words, the model may not be tricked by one loud command, but by a sequence that gradually narrows the safe path out of existence.

For defenders, the relevant question is not whether an agent can “think.” It is what the agent can touch if it is nudged in the wrong direction. Files, credentials, outbound network access, and writable code paths define the blast radius. Without sandboxing and tight egress controls, a summary task can become a launch point.

At the time of writing, the most defensible reading is narrow: this is a demonstration of indirect prompt injection against an agentic coding workflow, not proof that every deployment of the tool is equally exposed.

Conclusion

The broader lesson is uncomfortable but clear. As AI tools gain permission to read, reason, and act, the web itself becomes part of the attack surface. Security teams should treat external content as hostile input, isolate agent runtimes, and require human review for sensitive operations. In agentic systems, the boundary that matters most is not the prompt box. It is the line between reading and doing.

WIKICROOK

• Prompt injection: A technique where malicious content steers an AI model away from its intended instructions.
• Indirect prompt injection: Prompt injection delivered through content the model later reads, such as a web page or document.
• Auto Mode: A permission mode that routes tool use through approval logic, reducing risk but not creating a hard security boundary.
• Agentic AI: An AI system that can take actions with tools, not just generate text.
• Sandboxing: Isolation that limits what a process can access if it is manipulated or compromised.