Breaking Claude Code Opus 5 Auto Mode
Simon Willison’s Weblog 1 month ago 11
Anthropic made Claude Code’s auto mode the default to help protect coding agents from prompt injection attacks, but prompt injection researcher Johann Rehberger reported an attack that works 80% of the time. The attack tricks Claude Code into downloading and uncompressing a zip archive, then executing code that imports base64 and ends up executing a local extracted file. As a result, the story argues that sandboxing with restricted access (e.g., container/VM, limited network egress, monitoring) is the safer way to run unattended agents.