One website was enough to make an AI agent run a stranger's code
On 26 August 2026 the security researcher Johann Rehberger published an attack against an AI-based development tool, and by the 30th it had reached the Israeli press. The request that started it was ordinary: summarise a website. At the end of the chain an attacker's code was running on the machine, and it kept running after the conversation with the agent was closed.
What makes this matter now is the timing rather than the attack. In mid-August 2026 the permission mode called Auto Mode became the tool's default. In that mode the tool does not stop and ask before each action. It hands the decision to an automatic classifier that is supposed to block dangerous ones. Anyone who installed the tool and left the settings alone is now working without manual approval, whether or not they chose that.
How it worked
Every step in the chain looks fine on its own. The hostile site returns an error that stops the tool from using its normal browsing function, so the tool falls back to fetching the page with a plain download command. What comes down is an archive holding three things: encoded data, an executable meant to decode it, and a file named struct.py.
Here is the interesting part. The tool refuses to run an executable that arrived from the internet, which is exactly what its safety behaviour is meant to produce. Instead it writes its own short script to decode the data. That script, written by the tool and therefore treated as legitimate, runs inside the folder the archive was extracted into. In Python, a file sitting in the current folder takes priority over the system library of the same name. The attacker's struct.py loads instead of the real library, and at that moment the attacker's code is running.
The refusal to perform the dangerous action is what opened the hole. The safety mechanism worked, and the result of it working was that the tool wrote the thing that brought it down.
The code that runs opens a separate process, pulls a further stage off the network and opens a channel back to the attacker's server. That process is detached from the conversation and survives it. Rehberger reports three variants of the attack succeeding in three of five runs, three of five, and four of five. That is 60 to 80 percent.
One detail deserves particular attention. After the tool noticed something had gone wrong and tried to clean up, the same automatic classifier that was meant to protect it blocked the cleanup commands. The protection stopped the repair rather than the damage.
What the company said
The report went to the company that builds the tool, and it was closed as "informative" rather than logged as a vulnerability. The position given is that Auto Mode is a convenience mechanism resting on a best-effort classifier, not a security guarantee. A deliberate chain of steps that are each innocuous on their own falls outside what the mechanism is built to catch. The real security boundary, on that view, sits in operating-system level isolation and in limiting outbound traffic from the machine.
That is a candid answer, and it moves the responsibility to the user. Anyone running an agent in automatic mode should assume that the approval the agent grants itself is no evidence the action is safe.
Why a small business should care
The scenario reads as technical, but the assumption underneath it is plain: content the agent reads can dictate what it does. That holds for any agent reading websites, email, files a client sent, or documents that arrived over WhatsApp. The distance between this case and an agent that sorts your receipts is the scope of its permissions, not the principle.
A self-employed person usually has one computer. The bookkeeping files sit on it, along with passwords saved in the browser, access to the bank account, signing certificates and API tokens. An agent running there without manual approval runs with all of that within reach.
Three actions change the picture. Check which permission mode your tool is running in and put it back to manual approval if it moved to automatic on its own. Separate the environment: an agent that runs code or downloads files belongs in a virtual machine or a container, not in the same user account that holds the passwords and the invoices. And do not point an agent at an address that came from a source you did not ask, the same way you do not click a link in mail from someone you do not know.
Letting an agent touch the business files and the business accounts is granting it power of attorney. Worth knowing what it says.