Lobsters front page snapshot and original · Published 2026-08-30
Claude Code Auto Mode: an external-content execution risk
Even after refusing an external program, a self-written script may load untrusted code from the same directory. A researcher’s test separates approving a command from isolating its environment.
Where reading turns into execution
Researcher wunderwuzzi reports that Claude Code can load untrusted code while running a script it wrote to read external material. The experiment distinguishes automatic approval from isolation of the execution environment.
In the reported case, the model rejected a supplied program but ran its replacement script in an untrusted directory, indirectly loading code there. The report also records runs that recognized or avoided the risk.
Two percentages with different test conditions
The account connects model decisions, tool use and the local runtime: inspecting the immediate command may miss behavior in its dependencies.
This is the author’s targeted experiment, not a BitShovel replication. Each variant had five trials. Its 60–80% results and 0% on a different fixed benchmark are not directly comparable or generalizable to every version and configuration.
Important additions and corrections
Dates below mark changes to our coverage.
- Correction ·
Corrected the direct comparison between different test sets and clarified the experimental conditions and limits.
Sources and notes
sources中文
Sources and notes
- Read the originalLobsters front page snapshot and original
Sources and evidence · 2 links
Each link has a purpose and scope. Link counts do not establish independent confirmation; direct support applies only to the statements specified below.
Source timeline
- · Entered the BitShovel radar: 25 entries in the current Lobsters front page feed.
Collection record
First discovered:
Collection and source publication have distinct dates.
Editorial record
Corrected
· Beijing time (UTC+8)
Corrected the direct comparison between different test sets and clarified the experimental conditions and limits.
Sources and full record
This dates our review of the wording and sources, not a project release or product update.
Full record: before, after and sources (JSON)