Claude Code Auto Mode broken by prompt injection

Johann Rehberger of Embrace The Red published a prompt-injection chain that walks Claude Code running Opus 5 in Auto Mode all the way to code execution on the developer's machine. The write-up is practitioner research against an agent permission mode, not a vendor-tracked remote code execution bug with a CVE and a patch. His success rates come from a small sample, and Anthropic points to a commissioned benchmark that logged a very different number.

Auto Mode became Claude Code's default starting mode in mid-August. It swaps the old per-action human approval prompt for a safety classifier. Rehberger's chain feeds the agent malicious instructions through fetched web content, the classic indirect prompt injection that our explainer on what prompt injection is covers.

When the agent's WebFetch call returns an HTTP 415, the agent decides on its own to retry with curl, and the attacker's server answers with a redirect to a ZIP archive. Claude refuses to run the supplied native binary decoder and instead writes its own Python decoder. As Rehberger puts it, "Ironically, that safety decision is the exploit path."

That decoder runs inside the attacker-controlled extracted directory, where a planted local struct.py shadows the standard-library module. The moment the code imports base64, Python pulls in the poisoned struct first and the payload fires. Variants then either stage a command-and-control callback through an isolated Python child process or spawn a second headless agent with claude -p that carries its own tool access.

Across three variants Rehberger reports attack success of 3 of 5, 3 of 5, and 4 of 5 runs, so 60%, 60% and 80% on a deliberately small sample. Anthropic commissioned Trajectory Labs to evaluate 72 indirect prompt-injection scenarios ten times each, and that set logged 0.00% attack success for Opus 5 in Auto Mode. Rehberger's working chain was not among those 72 scenarios, so the clean benchmark and the novel exploit measure different things.

Auto Mode is, in Anthropic's own framing, a convenience feature backed by a best-effort classifier, not a security guarantee. Rehberger's line is blunter: "a classifier is not a sandbox." The real boundary for an unattended coding agent is operating-system isolation and network egress control, not the model's willingness to say no.

In some runs Claude detected that it had been compromised and tried to kill the process it had launched, and Auto Mode denied the cleanup command. A permission layer that blocks the agent's own remediation while the payload keeps running is the worst of both worlds.

Some offers on this page may be paid placements or contain affiliate links.