Breaking Claude Code Opus 5 Auto Mode

Anthropic has been betting a lot on Claude Code’s auto mode as a shield against prompt injection, and it recently made that mode the default. The company has also been making pretty bold claims about how well it works. That makes Johann Rehberger’s latest finding awkward for them.

Rehberger, who has built a strong reputation in prompt-injection research, says he found an attack that succeeds about 80% of the time. The trick starts with getting Claude Code to download and unpack a zip file. From there, the agent is pushed into running code that imports base64, without noticing that Python will first pull in a local struct.py file that came out of the archive. That file gets executed instead.

What makes this worse is that the failure does not stop at the moment of compromise. In some runs, auto mode directly prevented Claude from stopping the harmful process after it realized something had gone wrong. Claude noticed the problem. The system meant to keep it safe then blocked the cleanup command.

So the safety layer itself became part of the failure. It allowed the malware process to start, then got in the way when the agent tried to shut it down. That is a pretty brutal reminder that “safe by default” is not the same as actually safe.

The lesson here is not subtle: if an agent might face an adversary, it needs real isolation. Rehberger’s advice lines up with that — use a container, VM, or OS sandbox, restrict network egress, and keep home directories, SSH keys, and cloud credentials out of reach.