Claude Code Auto Mode broken by prompt injection

Johann Rehberger of Embrace The Red has published a prompt-injection chain that walks Claude Code running Opus 5 in Auto Mode all the way to code execution on the developer's machine. Read this as practitioner research against an agent permission mode, not a vendor-tracked RCE with a CVE and a patch. The success rates are small-sample, and Anthropic points to its own benchmark that shows a very different number, so both the attack and the defense claim need to sit on the page together.

Name the technique, and the step that does the damage

Auto Mode became the default starting mode in Claude Code in mid-August, and it swaps the old per-action human approval prompt for a safety classifier. Rehberger's chain feeds the agent malicious instructions through fetched web content, the classic indirect prompt injection. When the agent's WebFetch call returns an HTTP 415, the agent decides on its own to retry with curl, and the attacker's server answers with a redirect to a ZIP archive. Claude refuses to run the supplied native binary decoder and instead writes its own Python decoder, and, as Rehberger puts it, "Ironically, that safety decision is the exploit path." That decoder runs inside the attacker-controlled extracted directory, where a planted local struct.py shadows the standard-library module; the moment the code imports base64, Python pulls in the poisoned struct first and the payload fires. That step is module shadowing, and it is the hinge of the whole exploit. Variants then either stage a command-and-control callback through an isolated Python child process or spawn a second headless agent with claude -p that carries its own tool access.

The numbers, and the dispute the numbers create

Across three variants Rehberger reports attack success of 3 of 5, 3 of 5, and 4 of 5 runs, so 60%, 60% and 80% on a deliberately small sample. Set against that, Anthropic commissioned Trajectory Labs to evaluate 72 indirect prompt-injection scenarios ten times each, and that set logged 0.00% attack success for Opus 5 in Auto Mode. Both can be true at once. Rehberger's working chain was not among those 72 scenarios, so a clean benchmark and a reliable novel exploit are not in contradiction; they measure different things. The honest reading is that Auto Mode is, in Anthropic's own framing, a convenience feature backed by a best-effort classifier, not a security guarantee. Rehberger's line is blunter: "a classifier is not a sandbox." The real boundary for an unattended coding agent is operating-system isolation and network egress control, not the model's willingness to say no.

The failure mode operators should sit with

The sharpest detail is not the break itself but what happened after. In some runs Claude actually detected that it had been compromised and tried to kill the process it had launched, and Auto Mode denied the cleanup command. A permission layer that blocks the agent's own remediation while the payload keeps running is the worst of both worlds, and it is the reason "the model noticed" is not a control you can bank on. If you want to understand how the initial foothold is planted, our explainer on what prompt injection is covers the delivery step Rehberger relies on.

The takeaway

If you run Claude Code or any coding agent unattended, do not treat Auto Mode as the security boundary; run the agent inside a sandbox with real filesystem isolation and outbound network controls, and assume the classifier will eventually be talked around. The concrete move this week is to check whether your agent can reach the open internet and write outside a scratch directory, because the chain needs both a fetch it can follow and a directory it controls to plant the shadowing module. Watch whether Anthropic tightens Auto Mode's handling of self-written decoders and locally shadowed imports; until it does, the 0.00% benchmark is a statement about one test set, not about the machine your agent is running on.

For related AI-security context, see our coverage of the OpenAI-led collective cyber defense letter, ServiceNow's CVSS 10 AI-platform flaws, and what prompt injection is.