Can a Webpage Trick Your AI Agent Into Doing Something Dangerous?

A person can read a webpage as information. An AI agent may also have to decide whether some of that information is an instruction. That difference creates a security problem when the agent has permission to use tools.

Security researcher Johann Rehberger demonstrated a prompt-injection chain involving Claude Code Opus 5 running in Auto Mode. The starting task appeared harmless: summarise a webpage. A malicious page then attempted to steer the agent through a sequence of actions that ultimately reached unintended code execution in a controlled demonstration.

This is not a reason to conclude that Claude is uniquely unsafe or that businesses should never use AI agents. It is a reason to treat the boundary between information and authority as part of the security design.

What the research demonstrated

The reported chain used a seemingly ordinary webpage-summary request and malicious content that tried to influence the agent. In different controlled variants, the chain involved an archive and unintended code execution. One demonstration contacted a researcher-controlled server and opened Calculator; another reportedly launched another Claude session capable of additional actions.

Do not turn a small test into a general compromise rate

Rehberger reported that three attack variants succeeded in approximately 60–80% of attempts across five tests each. He also described the testing as not comprehensive.

The accurate interpretation is that several attack variants succeeded in three or four of five attempts in a small targeted test. That demonstrates a plausible attack chain. It does not establish that Claude, or AI agents generally, can be compromised at an 80% rate.

What prompt injection means

Traditional malicious code tries to exploit software. Prompt injection attempts to manipulate the instructions followed by an AI system.

• Webpages.
• Documents and PDFs.
• Emails and support tickets.
• Source repositories.
• CRM notes.
• Tool outputs.
• Supplier information.

The hostile instruction may be visible, hidden in formatting or mixed into otherwise useful information. An agent has to distinguish between information to understand and instructions to follow, even though both arrive as text or data.

Why agents change the risk

A text chatbot may mainly produce text. An agent can be connected to files, shell commands, repositories, networks, development tools, credentials, cloud services and business applications.

A manipulated agent with no useful permissions may be inconvenient. The same agent with production access, deployment tokens and a wide network route may be a serious incident waiting to happen.

Be fair to Anthropic's design

Anthropic designed Auto Mode to reduce repetitive approval prompts while using automated safety checks. Anthropic also recognises prompt injection within the threat model and publishes guidance about sandboxing.

The lesson is not that a vendor is unaware of the problem. It is that a probabilistic model-level safeguard should not be confused with a hard technical boundary.

Classifier versus sandbox

• A safety classifier attempts to decide: should this action be allowed?
• A sandbox technically limits: even if the action is attempted, what can it reach?

Contain the blast radius

Businesses should design on the assumption that an agent may eventually see content that tries to manipulate it. The question is not only whether the model spots the attack. It is what the agent can reach if it does not.

• Isolate the filesystem.
• Restrict network connections.
• Use limited credentials.
• Allow access only to required directories.
• Separate experiments from production.
• Limit cloud permissions.
• Use least privilege.

If this agent were manipulated, what could it actually reach? That question should have a specific, testable answer.

Credentials should not be an afterthought

API keys, Git credentials, cloud credentials, database strings, deployment tokens and .env files can turn a prompt-injection problem into a wider compromise. If an agent can see everything, a successful manipulation can affect everything.

Human approval should follow consequence

Requiring approval for every trivial action creates approval fatigue. Stronger approval controls make more sense for actions with a high consequence if they are wrong.

• Production deployment.
• Database changes.
• Sending confidential data externally.
• Installing unfamiliar software.
• Modifying security controls.
• Deleting important resources.

Ask: what is the consequence if this action is wrong? Then design the approval, isolation and recovery controls around that answer.

This applies beyond developers

Future business agents may read email, support tickets, documents, websites, CRM records and supplier information. They may then be authorised to send emails, update records, trigger workflows, create documents or modify systems.

If an AI agent reads something written by somebody outside your organisation, how much authority does it have afterwards? That is a business-security question, not only a developer question.

IT Club Agent Safety Check

1. 1What external information can the agent read?
2. 2Which sources are untrusted?
3. 3What tools can it use?
4. 4Which files can it access?
5. 5Which credentials can it see?
6. 6Where can it connect?
7. 7Can it access production?
8. 8Which actions require human approval?
9. 9What is the worst thing it could do if manipulated?
10. 10Is that blast radius acceptable?

AI Needs Guardrails: Why Useful AI Still Needs Boundaries →

Giving AI agents access to your business systems?

Ask the IT Club Advisor. Describe what you are automating and what access the agent requires, and we will help you think through the practical boundary.

Sources and further reading

This is original IT Club commentary. The research described a small targeted demonstration, not a general compromise rate. AI agent products and safety controls continue to change, so review current vendor guidance before granting access to business systems.

Embrace The Red: Claude Code Opus 5 and Auto Mode research →

Anthropic: Claude Code Auto Mode →

Anthropic: Claude Code sandboxing →