Back to Devoured - August 28, 2026
DEVOURED
Breaking Claude Code Opus 5 Auto Mode

Breaking Claude Code Opus 5 Auto Mode

AI securityllm Simon Willison
Security researcher Johann Rehberger demonstrated a prompt injection attack against Claude Code's auto mode that successfully executes malicious code 80% of the time.
What: The attack tricks Claude Code into downloading a zip archive and executing a local 'struct.py' file. The agent's safety classifier, intended to block malicious processes, often incorrectly blocks the user's subsequent attempts to terminate the malware, effectively aiding the exploit.
Why it matters: This reveals a critical failure mode in 'auto mode' agents where safety guardrails can be weaponized against the user when the agent is successfully compromised.
Takeaway: Always run autonomous coding agents in isolated environments such as containers or sandboxes with restricted network access and no exposure to SSH keys or cloud credentials.
Deep dive
  • The attack circumvents agent safety by exploiting the file system and local imports.
  • Claude Code's classification system exhibited a 'double failure' where it failed to stop the initial execution but later prevented the user from cleaning up the process.
  • This event underscores that agent-based autonomy significantly expands the attack surface for prompt injection.
Decoder
  • Prompt Injection: A security vulnerability where an attacker provides malicious input to an AI model to override its system instructions and force it to execute unintended actions.
  • Auto Mode: A feature in coding agents that allows the model to autonomously execute commands or scripts without requiring explicit user approval for every step.
Original article

Breaking Claude Code Opus 5 Auto Mode

Anthropic are putting a great deal of faith in Claude Code's auto mode for protecting their coding agent users against prompt injection attacks. They recently made that the default and have made bold claims about its effectiveness.

Johann Rehberger is one of the most credible prompt injection researchers active today. He found an attack against auto mode which he claims works 80% of the time, by tricking Claude Code into downloading and uncompressing a zip archive, then executing code that imports base64 without noticing that this will import and execute a local struct.py file extracted from the archive.

In a few cases auto mode directly prevented the agent from preventing harmful code from continuing to execute!

In a few runs Claude tried to terminate the malware process once it noticed the compromise, but Auto Mode denied the cleanup command.

Claude detects the compromise, but Auto Mode blocks its cleanup command

The safety mechanism itself can become part of the failure. The classifier allowed the creation of the malware process, but then it blocked the command intended to stop it!

I agree with Johann's conclusion here: the only safe way to run agents if there's any risk of attracting the attention of an adversarial attack is with a sandbox:

  • Run unattended coding agents in a container, VM or OS sandbox.
  • Restrict network egress.
  • Monitor your agents.
  • Do not expose home directories, SSH keys, cloud credentials,… to the agent runtime.
Explore all 55 articles in today's digest

Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi