Prompt Injection Hijacks Claude Code Opus 5 Auto Mode — Detection and Hardening Guide

---
title: Claude Code Agent Spawning Shell or Script Interpreter
description: Detects the Node.js runtime hosting Claude Code spawning command shells or script interpreters, consistent with indirect prompt injection driving tool-use execution in Auto Mode.
references:
  - https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
id: 9b2c4d71-3f5a-4e8b-a1c6-7d9e2f4a8b01
status: experimental
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\claude.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate Claude Code tool calls running developer build/test scripts — baseline per-developer and alert on new child-process types not seen in the prior 14 days
level: high
---
title: Suspicious Download or Execution Command in AI Agent Process Tree
description: Detects encoded PowerShell, download cradles, and remote script execution patterns in any process tree rooted at Node.js or Claude Code, a strong indicator of prompt-injection-driven code execution.
references:
  - https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/04/06
id: 4e7a1c93-8b2d-4f6e-9a3c-1d5b7e9f2a04
status: experimental
tags:
  - attack.execution
  - attack.t1059.001
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'claude'
      - '\node.exe'
  selection_payload:
    CommandLine|contains:
      - '-enc'
      - '-encodedcommand'
      - 'iex'
      - 'invoke-webrequest'
      - 'invoke-expression'
      - 'downloadstring'
      - 'certutil -urlcache'
      - 'curl -o '
      - 'curl.exe http'
      - 'wget http'
  condition: selection_parent and selection_payload
falsepositives:
  - Rare; developer automation via Claude Code seldom uses encoded commands or download cradles
level: critical
---
title: Claude Code Session Network Egress to Untrusted Content Followed by Local Execution
description: Detects Node.js/Claude Code establishing outbound HTTP connections to rarely contacted domains, a precursor step in indirect prompt injection where the agent fetches attacker-controlled content.
references:
  - https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/04/06
id: 2c5f8a14-6d3b-4e7a-b9c1-8f2d4a6e0b37
status: experimental
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\node.exe'
      - '\claude.exe'
    DestinationPort:
      - 80
      - 443
  filter_known:
    DestinationHostname|endswith:
      - 'anthropic.com'
      - 'claude.ai'
      - 'github.com'
      - 'raw.githubusercontent.com'
      - 'registry.npmjs.org'
  condition: selection and not filter_known
falsepositives:
  - Developer research browsing via agent fetch tools — correlate with subsequent child-process execution before escalating
level: medium

// Hunt: Node.js (Claude Code runtime) spawning shells, script engines, or download tools
// Scope: developer workstations; baseline dev tooling first to cut noise
let lookback = 14d;
let agentParents = dynamic(["node.exe", "claude.exe"]);
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName in~ (agentParents)
| where FileName in~ ("powershell.exe","pwsh.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","curl.exe","certutil.exe","bitsadmin.exe")
    or ProcessCommandLine has_any ("-enc", "-encodedcommand", "iex", "downloadstring", "certutil -urlcache", "curl -o ", "wget http")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, InitiatingProcessRemoteUrl
| order by Timestamp desc;

// Correlation: agent HTTP egress to uncommon domains, followed within 5 minutes by local child-process execution
let agentNet = DeviceNetworkEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName in~ (agentParents)
| where RemotePort in (80, 443)
| where not(RemoteUrl has_any ("anthropic.com","claude.ai","github.com","npmjs.org","microsoft.com"))
| summarize FirstFetch=min(Timestamp) by DeviceName, RemoteUrl;
let agentExec = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName in~ (agentParents)
| where FileName in~ ("powershell.exe","pwsh.exe","cmd.exe","curl.exe","certutil.exe")
| summarize FirstExec=min(Timestamp), Commands=make_set(ProcessCommandLine) by DeviceName;
agentNet
| join kind=inner agentExec on DeviceName
| where FirstExec between (FirstFetch .. FirstFetch + 5m)
| project DeviceName, RemoteUrl, FirstFetch, FirstExec, Commands;

-- Hunt for Claude Code / Node.js agent process trees with suspicious children
-- and recent web-fetch artifacts indicative of prompt injection delivery
LET procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)node|claude'
   OR CommandLine =~ '(?i)claude'

LET suspicious_children = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM procs)
  AND (Name =~ '(?i)powershell|pwsh|cmd|curl|certutil|wscript|cscript|mshta|bash|sh'
       OR CommandLine =~ '(?i)-enc|encodedcommand|iex|downloadstring|urlcache|curl -o|wget http|bash -c|sh -c')

SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime
FROM suspicious_children

-- Also enumerate Claude Code configuration for review of Auto Mode and permission state
SELECT * FROM glob(globs=[
  'C:/Users/*/.claude/settings.json',
  'C:/Users/*/.claude.json',
  '/home/*/.claude/settings.json',
  '/Users/*/.claude/settings.json'
])

# Security Arsenal - Claude Code Auto Mode Exposure Audit & Hardening (Windows)
# Run elevated on developer workstations or deploy via RMM/Intune

$report = @()

# 1. Detect Claude Code installation and version
$claudeCmd = Get-Command claude -ErrorAction SilentlyContinue
if ($claudeCmd) {
    $ver = (& claude --version 2>$null)
    $report += [pscustomobject]@{ Check = 'ClaudeCodeInstalled'; Result = $ver; Risk = 'Info' }
} else {
    $report += [pscustomobject]@{ Check = 'ClaudeCodeInstalled'; Result = 'Not installed'; Risk = 'None' }
}

# 2. Enumerate user-level Claude settings for dangerous permission modes
$settingsPaths = Get-ChildItem 'C:\Users\*\.claude\settings.json' -ErrorAction SilentlyContinue
foreach ($p in $settingsPaths) {
    try {
        $cfg = Get-Content $p.FullName -Raw | ConvertFrom-Json
        $mode = $cfg.defaultMode
        if ($mode -eq 'auto' -or $mode -eq 'bypassPermissions' -or $mode -eq 'acceptEdits') {
            $report += [pscustomobject]@{ Check = 'PermissionMode'; Result = "$($p.FullName): $mode"; Risk = 'HIGH' }
        }
        # Flag overly broad tool allowlists
        if ($cfg.permissions.allow -contains 'Bash(*)' -or $cfg.permissions.allow -contains 'WebFetch(*)') {
            $report += [pscustomobject]@{ Check = 'PermissiveToolAllowlist'; Result = $p.FullName; Risk = 'HIGH' }
        }
    } catch {}
}

# 3. Check for MCP servers configured (third-party tool servers expand injection surface)
$mcpPaths = Get-ChildItem 'C:\Users\*\.claude.json' -ErrorAction SilentlyContinue
foreach ($p in $mcpPaths) {
    $raw = Get-Content $p.FullName -Raw
    if ($raw -match '"mcpServers"\s*:\s*\{[^}]') {
        $report += [pscustomobject]@{ Check = 'MCPServersConfigured'; Result = $p.FullName; Risk = 'Review' }
    }
}

# 4. Hunt recent process telemetry (Sysmon) for node.exe spawning shells in last 24h
$events = Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-Sysmon/Operational'; Id=1; StartTime=(Get-Date).AddHours(-24) } -ErrorAction SilentlyContinue
foreach ($e in $events) {
    $msg = $e.Message
    if ($msg -match 'ParentImage:.*node\.exe' -and $msg -match 'Image:.*(powershell|cmd|curl|certutil|wscript)') {
        $report += [pscustomobject]@{ Check = 'SuspiciousAgentChildProc'; Result = ($e.TimeCreated.ToString() + ' ' + $msg.Substring(0,[Math]::Min(300,$msg.Length))); Risk = 'CRITICAL' }
    }
}

# 5. Recommended hardening: write a managed settings policy requiring human approval
$managedDir = 'C:\ProgramData\ClaudeCode'
New-Item -ItemType Directory -Path $managedDir -Force | Out-Null
@'
{
  "permissions": {
    "defaultMode": "default",
    "deny": ["Bash(curl:*)", "Bash(wget:*)", "Bash(powershell:*)", "WebFetch(*)"]
  }
}
'@ | Set-Content "$managedDir\managed-settings.json" -Force
$report += [pscustomobject]@{ Check = 'ManagedPolicyDeployed'; Result = "$managedDir\managed-settings.json"; Risk = 'Remediated' }

$report | Format-Table -AutoSize
$report | Export-Csv "$managedDir\claude-audit-$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation