Claude Code Opus 5 Auto Mode Vulnerable to Prompt Injection Attacks... Success Rate Up to 80%

In a third-party evaluation commissioned by Anthropic, the Auto Mode of Claude Opus 5 was reported to have a prompt injection attack success rate of 0.00%. However, cases were revealed where targeted attack chains achieved a success rate of up to 80%. This suggests that while Auto Mode replaces the human approval process through safety classifiers, using it without an isolated environment can expose users to serious security risks.

Attack Scenario and Mechanism

Attackers achieved code execution by exploiting a simple request asking the user to summarize website content. The key steps are as follows:

• Inducing Tool Switching: The server returns a 415 Unsupported Media Type error, prompting Claude to use curl instead of WebFetch.
• Malicious Archive Deployment: A ZIP archive is downloaded via curl, containing malicious binaries and Python scripts alongside normal metadata.
• Bypass Execution: Claude refuses to execute suspicious binaries but instead runs a Python decoder it wrote itself.
• Module Hijacking: A malicious struct.py file is placed in the directory where the decoder runs, causing malicious code to trigger when Python's standard library base64 module is imported.

Implications

Anthropic's Boris Cherny claimed that multi-layered defense systems, including model training, input probes, and intent classifiers, can reduce indirect prompt injection to near zero. However, this case demonstrates that such defense systems can be bypassed by specific attack chains. Therefore, Auto Mode cannot replace monitoring in isolated environments, highlighting the need to reconsider security perspectives when using AI agents.