What's this about?
The chain is worth reading in full because every step is individually reasonable. (1) The site returns `415 Unsupported Media Type` to Claude's `WebFetch` tool. Claude decides by itself to retry with `curl` — nobody told it to. (2) It is served a ZIP archive of plausible notebook records with catalogue metadata, dates and checksums. (3) The archive includes a native decoder binary; Claude correctly refuses to execute it and writes its own Python decoder instead. (4) But it runs that decoder from inside the attacker-controlled unzipped directory. (5) That directory contains a malicious `struct.py`. (6) Python resolves imports from the current directory first, so when Claude's decoder imports `base64`, which imports `struct`, the attacker's file loads. (7) Code execution.
What is import shadowing?
When Python imports a module it searches a list of directories, and the script's own directory usually comes first. Drop a file named `struct.py` next to the script and it wins over the standard library's `struct`. This is a decades-old footgun, well known, and normally harmless because you control your own directory. It becomes an attack when an agent unpacks someone else's archive and then runs code from inside it.
Why does this matter to you?
- The security failure is not the model refusing or not refusing — it refused correctly at step 3. The failure is the working directory.
- It is a clean argument that agent sandboxing has to include where code runs, not just what code runs.
- Every individual decision Claude made was defensible, which is what makes this hard to fix with better judgement rather than better isolation.