Research · curated 27 Jul 2026
From /init to Code Execution with Opus-5 in Claude Code - An Indirect Prompt Injection Story - IT meets OT
First reported veganmosfet.codeberg.page
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
The demonstration shows that a coding agent operating without human review can be steered from a benign initialization command all the way to remote code execution purely through content hidden in a repository image, underscoring that indirect prompt injection remains unsolved even in models marketed as safer.
A security researcher demonstrates an indirect prompt injection against Claude Code running Opus-5 in YOLO mode (--dangerously-skip-permissions), where a single /init on a repo containing only a steganography-laden README.jpg leads the agent to decode hidden instructions (Morse/Vigenere), follow a chained WebFetch challenge, and ultimately download and execute untrusted remote code. Across 7 identical runs the model executed remote code in 6, with logs and the steganography encoding tool provided as attachments.