[Bug] Auto mode executes untrusted scripts with curl
Open 💬 0 comments Opened Jul 9, 2026 by alexisLefebvre
Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code
What's Wrong?
In auto mode, Claude called insecure scripts in home directory:
● Serving fine. Now installing Deno and running the actual test suite.
● Bash(which deno || (curl -fsSL https://deno.land/install.sh | sh) 2>&1 | tail -20)
⎿ 0.3%# 2.8%#### 6.2%###########What if deno.land served a malware instead of an install script?
What Should Happen?
curl -fsSL … | sh or curl -fsSL … | bash can be dangerous, Claude should never call it on its own.
Error Messages/Logs
None.
Steps to Reproduce
I was working on a Supabase project with auto mode, Claude was working in background and it chose to run this command by itself, there was 0 question or confirmation asked.
Claude Model
Sonnet 5 / medium effort
Is this a regression?
I don’t know.
Last Working Version
I don’t know.
Claude Code Version
v2.1.205
Operating System
Linux: Debian 13.5.
Terminal/Shell
Other
Environment Info
- Platform: linux
- Terminal: ghostty
- Version: 2.1.205
- Feedback ID: d85ecb68-5446-4c0a-a943-eaecefd36c90