Claude Code Opus 5 Auto Mode Fails 80% of Prompt Injection Attacks

Anthropic applied Auto Mode as the default setting for Claude Code, claiming strong defenses against prompt injection attacks, but serious vulnerabilities were discovered in actual security research. Researcher Johann Rehberger discovered an attack vector where Auto Mode failed to block malicious code execution, with the attack showing a success rate of approximately 80%.

The attack works by inducing Claude Code to download and extract a zip archive, then executing code that imports the base64 module. During this process, a local struct.py file extracted from the archive is unintentionally imported and executed, causing the malicious code to run.

A more serious issue is that safety mechanisms themselves become part of the failure. In some cases, Claude detected the compromise and attempted to terminate the malicious process, but Auto Mode blocked the cleanup commands. The classifier allowed the creation of the malicious process but blocked the commands intended to stop it.

Consequently, Simon Willison emphasized that the only safe way to run agents in potentially risky scenarios is within a sandbox environment. The recommendations are as follows:

• Run asynchronous coding agents in containers, VMs, or OS sandboxes
• Restrict network outbound traffic
• Enhance agent monitoring
• Prohibit exposure of sensitive information such as home directories, SSH keys, and cloud credentials