security

More prompt-injection hijinks from wunderwuzzi

Anthropic’s Claude Code running Opus 5 in Auto Mode can be tricked into executing attacker-controlled code simply by asking the coding agent to summarize a website. The attack works up to 80 percent of the time, according to prompt-injection wizard Johann Rehberger, aka wunderwuzzi.

In a blog and video demo, he detailed how to hijack Opus 5 in Auto Mode, which is the default setting for Claude as of mid-August.

It starts off by asking the agentic coding model to summarize a malicious website that presents itself as an archive of notebook records, and then tricking Claude into using curl instead of its WebFetch tool to retrieve the contents of the page – but without directly telling the model to use curl.

The WebFetch request fails, returning a 415 Unsupported Media Type response, so the model decides to access the website directly by issuing a Bash tool call with curl. 

The website returns a 303 response, and redirects to a malicious ZIP archive, which Claude then downloads. This archive contains seemingly harmless files including catalog metadata, a README file, seven Base85/zlib-encoded JSON notebook records, a macOS decoder-darwin binary – plus a poisoned Python file named struct.py.

Claude, per its safety guardrails, refuses to run the decoder: “This is planned and what the attacker wants,” Rehberger wrote. Instead of using the supplied binary, the AI decides to write its own decoder. “Ironically, that safety decision is the exploit path,” Rehberger explained, adding a purple devil emoji to the text.

The new decoder imports base64, and from here the attack relies on Python module shadowing to trick the model into running the malicious struct.py code.

Module shadowing occurs when a local file shares the same name as a Python standard-library module. The local file hides the official module, causing Python to load it instead.

In this case, the standard-library base64 module imports the legitimate struct module, and the malicious ZIP contains a malicious file with the same name. 

Rehberger says he used ChatGPT to obfuscate the malicious struct.py code to bypass Claude’s safety controls, and this successfully launches a separate Python process to download and execute a remote payload – in this case a command-and-control callback, which in turn opens Calculator. We assume that real attackers would execute something a little more nefarious.

In another attack scenario, struct.py launches a second, headless Claude Code via claude -p, meaning this prompt injection can be used not just to remotely execute code, but rather to create a whole new agent.

“The nested Claude gets its own tool access and context,” Rehberger wrote. “In these runs the child performed basic recon (whoami, uname, id), opened Calculator and wrote to local files in the home folder.”

Across three variants tested five times each, which Rehberger noted were small samples, he reported success rates between 60 percent and 80 percent. “I would say that these results are representative for a motivated attack, but not comprehensive.”

Anthropic did not respond to The Register’s request for comment, but reportedly told Rehberger that the model’s “behavior is working as designed.” We’ve heard this one before.

“Auto Mode is a convenience feature backed by a best-effort classifier, not a security guarantee,” Rehberger wrote, paraphrasing Anthropic’s response to his security report. 

According to Rehberger, the classifier isn’t built to stop determined prompt-injection chains made up of individually benign-looking steps, and the real boundary is OS isolation and network egress control.

The key takeaway, according to Rehberger, is to run this and other coding agents in a sandbox.

“The solution is something we talked about for many years,” he wrote. “Do not trust the model output.”®

Training AI models with other AI models has become a very popular goal for neolabs — and now, a researcher in Anthropic’s fellows program has given us an early look at what it might look like in practice.

On Friday, Anthropic published a new paper titled “Automated Researchers Can Reliably Mitigate Alignment Failures,” detailing how AI systems could reliably improve a model’s performance on a set of alignment benchmarks. When given 10 benchmarks for specific misaligned behaviors, the automated systems were able to improve performance on every single one without degrading overall performance.

Led by Anthropic fellow Chen Yueh-Han, the system replicates much of the traditional approach to research. Each automated system searches the available literature, proposes a method, and trains the model using that method for 30 minutes, gradually increasing the benchmark over several iterations. Effective methods are preserved while ineffective ones are discarded, allowing the system to operate quickly and at a great scale.

“Overall, these results provide early evidence that automated alignment post-training could become practical in the near term,” the paper reads.

The paper is a step toward recursive self-improvement, which many see as the next significant step in AI progress. If models can improve their own alignment training, it’s plausible they could improve training practices more broadly — at which point, human AI researchers might soon become obsolete.

The paper isn’t shy about addressing this idea, explicitly comparing the Automated Alignment Researcher (AAR) to its human equivalent. “The best AAR method beats what experienced humans propose, on average within six hours,” the paper reads. “Human guided research directions do not lead to stronger performance.”

There’s even a cost comparison, in case anyone wasn’t convinced. “An AAR costs roughly $4 per hour in API inference against the $150 per hour we pay our human researchers.”

In fairness, the paper also points out a few limitations to this approach. The automated system only works insofar as the benchmarks reflect the actual alignment goals, and even then there’s significant work to be done in establishing and maintaining those benchmarks — not to mention maintaining and expanding on the literature the automated researchers are drawn from.

The Dreamcast era of games was a fever dream of wild, original ideas — Space Channel 5, Seaman, Shenmue, Chu Chu Rocket, Power Stone, Jet Set Radio and more — and perhaps nothing exemplified it better than Crazy Taxi, a game with its pitch in the name. Now, Sega is bringing its zany taxi driving classic back for modern consoles with Crazy Taxi: World Tour — and I got my hands on it for a short preview.

At a hotel in downtown Los Angeles, Sega lined up a half-dozen games for its summer press showcase, but my retro gaming heart was fixed on Crazy Taxi. Our current string of remasters is bringing some iconic games to modern audiences, but some, like Silent Hill 2 Remastered and Metal Gear Solid Delta, are based on games so canonized that the revivals aren’t surprising. Crazy Taxi wasn’t a milestone in gaming, but it’s a standout representation of the kinetic energy found in the best of Dreamcast’s game catalog, and I’m delighted to see it brought back.

Mind you, I only got about an hour with the new Crazy Taxi, which is due out in 2027, but I appreciated seeing what Sega kept from the original game — mostly vibes and its vibrant visual style, along with its signature fare-pickup system. You still drive up to a colorful circle representing a person in dire need of a quick ride and slam the accelerator to get them to their destination, haplessly crashing through cars and around pedestrians as the timer counts down. And yes, that sweet late ’90s-to-early 2000s alt rock and pop punk soundtrack is back — just take a listen to Sega’s latest trailer.

Unlike the original, there’s more to the game than just picking up fares until your time runs out. There are several modes in Crazy Taxi: World Tour, and the one I played was more of a free-form sandbox that let players drive around. The preview only had the map for Germany, one of many international locations in the final game, which was a large loop broken up by smaller zones — an airport, a city downtown, a small village and a castle on a hill. 

It was in these German-themed pockets that I found my favorite feature of World Tour — specialized fares with their own mini-quests to complete. There were about 10 scattered around the map, and they were all some variation of insane. One was an unsettlingly enthusiastic man in an Easter Bunny costume asking me to help “collect his eggs,” another a daredevil in a wingsuit who wanted to be launched off a cliff from my cab’s backseat. Their dialogue suggested that I’d likely run into these bizarre specimens in other maps and had similarly assisted their bizarre life goals.

This, this, is the Sega Dreamcast energy — the juxtaposition of exaggerated life with funky characters who took it to the next level. After every exhaustingly serious samurai game about regaining honor, beyond each deep RPG with a desperate quest to save the planet, I yearn for a game where I can enter the most lighthearted, dumb-in-the-best-way world of escalating inanity. 

Sure, I can find some of that wackiness in emergent gameplay with my friends during a Big Walk or Peak or other modern party games. But I want the delight of a scripted weirdo, someone the game developers unearthed from a twisted corner of their brain that makes me laugh. Unsurprisingly, I often find this in Sega studio RGG’s Yakuza games. But in what I’ve seen, Crazy Taxi: World Tour brings back a bit of that classic, no-explanation-necessary oddball style I remember from booting up the latest Dreamcast game at the turn of the millennium.

As I found in my World Tour preview, where else could I pick up a sleazeball Lothario trying to escape his latest failed amorous encounter, dodging the missiles fired from pursuing cop cars, so I can drop my fare off literally on the wheels of a plane taking off? Keep the fares coming — the crazier, the better.

David Lumb

Managing Editor, Mobile

David Lumb is a managing editor for the mobile team, covering mobile and gaming spaces. Before CNET, he covered tech, gaming, and culture for TechRadar, Engadget, Popular Mechanics, NBC Asian America, Increment, Fast Company and others. As a true Californian, he lives for coffee, beaches and burritos.

See full bio

Record labels have never met a round-number anniversary they couldn’t monetize. Usually, I can hear the cash register before the lacquer has even been cut. Amy Winehouse’s Back to Black is one of those rare albums where I’m willing to holster most of the cynicism, because twenty years later, there is still nothing ordinary about the record or the woman who made it.

UMR/Island will release the 20th Anniversary Edition of Back to Black on October 23, 2026, almost exactly two decades after the album’s original October 27, 2006 UK release. The new collection will be available as a 3LP clear-vinyl set, 3CD edition and digital deluxe edition, with additional limited 1LP versions including Chalkboard Marble vinyl and a web-store-exclusive Zoetrope pressing. The expanded editions combine the original album with B-sides, demos, previously unreleased material and recordings from Winehouse’s February 8, 2007 performance at Paradiso in Amsterdam.

Why Back to Black Mattered

Calling Back to Black an important record feels almost inadequate at this point. Winehouse was only 23 when it arrived, but she sounded like someone who had already survived several lifetimes. The album took the vocabulary of 1960s girl groups, Motown, R&B, jazz and soul and dragged it into the 21st century without turning any of it into retro cosplay.

Producers Mark Ronson and Salaam Remi understood what they had in front of them and, rather wisely, did not polish away the sharp edges. Six of the album’s 11 songs used members of Sharon Jones & The Dap-Kings, helping give the record its muscular, analog-influenced foundation. Its success also helped bring vintage soul textures back into mainstream pop and opened the door for the wave of British singers that followed.

But production alone does not explain why the album endured. “Rehab,” “You Know I’m No Good,” “Love Is a Losing Game,” “Tears Dry on Their Own” and the title track were brutally personal songs about relationships, infidelity, addiction and heartbreak, delivered by somebody incapable of sounding emotionally detached from any of it.

Winehouse died from alcohol poisoning in July 2011 at the age of 27 after years of very public struggles with addiction. The tabloid circus often threatened to overwhelm the music, which makes returning to Back to Black all the more important. Before the spectacle took over, she was a devastatingly gifted songwriter and singer who created one of the defining albums of the 2000s.

The commercial and critical impact was enormous. Back to Black went on to sell more than 16 million copies worldwide, and Winehouse won five Grammy Awards in 2008. “Rehab” took Record of the Year, Song of the Year and Best Female Pop Vocal Performance, while Back to Black won Best Pop Vocal Album.

What Is Actually New?

This is not the first time Back to Black has been repackaged. A Deluxe Edition arrived in 2007 with B-sides, rarities and live material, while later releases included a half-speed-mastered 2LP edition and a 15th Anniversary picture disc. Apparently, owning Back to Black once is merely the opening bid.

The 2026 edition does add meaningful archival material, including four previously unreleased demos, along with additional demos and B-sides. The expanded material includes early versions of “You Know I’m No Good,” “Me & Mr Jones,” “Just Friends,” “Back to Black,” “Love Is a Losing Game” and “Tears Dry.” “Tears Dry (Alternative Demo)” was released digitally on August 25 as the first advance track from the anniversary campaign.

The other major draw is Winehouse’s February 8, 2007 Paradiso concert in Amsterdam. The 3CD and digital editions contain a 14-song performance featuring “Addicted,” “Just Friends,” “Cherry,” “Fuck Me Pumps,” “I Heard Love Is Blind,” “Back to Black,” “Rehab,” “Love Is a Losing Game” and “Valerie.”

Vinyl buyers should pay close attention to the tracklist. The published 3LP edition contains only 11 Paradiso performances, omitting “Cherry,” “Fuck Me Pumps” and “I Heard Love Is Blind.” Based on Universal’s own listings, the 3CD and digital editions are the options for listeners who want the full 14-song concert.

The physical deluxe editions also include alternate cover artwork, photographs of Winehouse’s handwritten lyrics from Mark Ronson’s archive, previously unseen images from original album photographers Mischa Richter and Alex Lake, and new liner notes from Ronson and Salaam Remi. The official UK store currently lists the clear 3LP edition for £51.99 and the limited Zoetrope LP for £35.99. Official U.S. pricing was not posted when we checked.

The Bottom Line

Do you need another copy of Back to Black? If you already own a strong pressing, especially the previous half-speed 2LP edition, probably not on vinyl alone.

What makes this anniversary package more interesting is the archival material. The unreleased demos and expanded Paradiso performance give longtime listeners something beyond a new color variant and a commemorative sticker, while the 3CD and digital editions appear to offer the most complete version of the live material.

Twenty years later, the album still sounds startlingly alive because Winehouse never treated soul, jazz and girl-group pop as museum pieces. She made those influences personal, contemporary and painfully direct.

We know how her story ended, and I still wish like hell that we didn’t. But if this edition sends another generation back to the music instead of merely back to the tragedy, it has done something worthwhile.

Where to buy:

Related Reading:

Facepalm: Squadron 42, Cloud Imperium’s single-player, cinematic sci-fi game set in the Star Citizen universe, has been delayed once again. The title, which was originally slated to launch more than a decade ago in 2015, is now expected to be released in Q2 2027.

In a message posted on the official Roberts Space Industries website, game director Chris Roberts said the decision is intended to avoid competing with GTA 6, which is scheduled to launch this November on PlayStation 5 and Xbox Series X|S after an extended development cycle and multiple delays over the past couple of years.

Roberts noted that the decision to delay Squadron 42 was made after much deliberation, as the media attention surrounding the launch of GTA 6 will leave very little room for reviewers, streamers, and content creators to cover other games launching in the same window.

According to Roberts, Squadron 42 is a labor of love, with “twelve years of blood, sweat and tears” invested in it, and he doesn’t want the game to get caught up in the “attention buzz saw” surrounding GTA 6. He added that his team ideally wanted to launch the game in early 2027 but decided it would be better to release it after the hype surrounding GTA 6 had died down.

While the vast majority of players will have to wait until 2027 to get their hands on Squadron 42, Cloud Imperium will give “a small number of original backers and long-time Star Citizen content creators” an opportunity to play the game on October 9 and 10. The final launch date will be announced shortly thereafter.

Roberts acknowledged that many Star Citizen faithful will be disappointed that they won’t get to play Squadron 42 this year, but insisted that “it is the best thing for the project as it is truly something special and so needs the opportunity to have the focus of the wider gaming world.”

Set in the Star Citizen universe, Squadron 42 is described as the spiritual successor to Wing Commander, featuring branching missions and first-person combat. The game was announced in 2013 via a Kickstarter campaign, with a tentative release date set for 2015. However, it has since been delayed multiple times, with the first gameplay video released only in 2024.

Squadron 42 is expected to be released in multiple episodes, with Episode One said to offer about 70 missions spanning an estimated 20 hours of gameplay. Episodes Two and Three will launch later. The game will feature a star-studded cast, including Mark Hamill, Gary Oldman, Henry Cavill, and Gillian Anderson, among others.

No Ban: Despite being essentially banned from the US market, Huawei still plays a major role in the global technology industry. The Chinese conglomerate holds several crucial patents and other intellectual property, which is why US corporations continue to do “business” with the company despite Washington’s restrictions.

HP Inc. recently announced a new patent deal with Huawei, a company that is unable to sell or import products in the US after being banned by the FCC. The agreement is essential for keeping the US company in the technology business, but HP felt compelled to provide an official explanation of exactly what is at stake.

Huawei was first to disclose the patent licensing agreement, but HP is now lamenting the fact that the arrangement has been deeply “mischaracterized.” The deal stems from a settlement in a legal dispute between the two companies, so there is no grand scheme or broader partnership at play here.

The deal will allow HP to access essential patents related to Wi-Fi technology, which Huawei holds significant intellectual property rights to. The Chinese corporation sued HP over these patents, asking its US counterpart to stop selling products based on the disputed IP. HP was either going to properly license the patents or join the legal fight and risk losing the case.

HP chose the former, as it essentially had no other choice but to enter into a licensing agreement with the Chinese corporation. Otherwise, the US manufacturer could have lost its ability to properly serve US customers. Other players in the technology industry are doing exactly the same, as Huawei holds essential Wi-Fi patents required to support wireless connectivity in computers, printers, and other devices.

However, the agreement does not force HP to buy any Huawei products, which are likely illegal in the US following the FCC’s decision. “HP is not incorporating any Huawei components or technology into HP products. The agreement is not a strategic partnership, nor a commercial alliance, nor a supply agreement, nor any other form of collaboration,” the company stated.

HP also said that this is an all-too-common issue that US technology companies eventually have to deal with. Some crucial connectivity technology is owned by Chinese companies, and companies cannot provide lawful, standards-compliant products to US customers without properly licensing the underlying intellectual property.

The new agreement with Huawei is part of a broader licensing effort related to Wi-Fi technology that involves both HP and other US-based corporations. The patent group in question is known as the Sisvel Wi-Fi 6 pool, a program offering a one-stop solution for accessing essential patents related to the 802.11ax (Wi-Fi 6) connectivity standard.

Lambda, an AI cloud company that buys computing chips and rents them out to businesses, has raised $1 billion in private, short-dated debt to buy Nvidia’s AI chips that it will lease to Microsoft, Bloomberg reports. 

The terms of the deal, which Bloomberg says was arranged by JP Morgan Chase, signal that Lambda is betting it will be able to quickly deploy the chips and start generating revenue from them, letting it repay the debt fairly quickly using that incoming cash.

This is the latest in a string of loans that Lambda is using to fund GPU infrastructure for specific customers. In May, it closed a $1 billion secured credit facility, and this week it announced the closing of a $926 million loan to fund Nvidia GB300 GPUs, one of Nvidia’s newest chip models, for a deployment it’s under contract to provide Nvidia.

The $1 billion private debt deal comes as Lambda is reportedly in talks for a $3 billion pre-IPO round. The company last November raised $1.5 billion in venture capital at a $5.43 billion post-money valuation, per PitchBook data.

Lambda isn’t the only one relying on debt to fund the AI boom — according to data Bloomberg compiled, banks and tech companies have raised over $400 billion in AI-related debt globally in 2026 so far.