GoKawiilResearcher demonstrates 60-80% prompt injection success against Claude Code's Auto Mode
A security researcher tested Anthropic's Claude Code Opus 5 in its default Auto Mode and found that a crafted website-summary request could hijack the agent into executing malicious code, succeeding in 60-80% of attempts on a small sample. The exploit tricks Claude into fetching a ZIP archive, writing its own Python decoder, and unknowingly running it inside an attacker-controlled folder where a poisoned struct.py file shadows Python's standard library and triggers code execution.
GoKawiil's interpretation of the reporting above, not reported fact.
Anthropic had touted a third-party evaluation showing a 0.00% attack success rate for indirect prompt injection in Auto Mode, using layered defenses like model training, input probes, and an intent classifier. This research suggests those defenses can be bypassed with a targeted, multi-step attack chain, undercutting confidence in Auto Mode as a replacement for human oversight or sandboxed execution when running AI coding agents.
- Auto Mode has been the default mode for Claude Code since mid-August, replacing manual approval prompts with an automated safety classifier.
- A researcher achieved 60-80% attack success rates against Auto Mode despite Anthropic's vendor-tested benchmark showing 0% success on indirect prompt injection.
- The exploit relies on tricking Claude into running its own generated code inside an attacker-controlled directory where a malicious file shadows a legitimate Python module.
Raspberry Pi 5 Single Board Computer — If the article's takeaway is that AI coding agents belong in an isolated environment, a dedicated Raspberry Pi 5 makes a cheap, physically separate sandbox for running agents and experiments. Wipe the SD card and start fresh whenever a run goes sideways, without touching your main workstation.
See Raspberry Pi 5 Single Board Computer on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: embracethered.com, 2026-08-31
Published there as: “Breaking Claude Code Opus 5 Auto Mode”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.