Breaking Claude Code Opus 5 Auto Mode · Embrace The Red
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A security researcher demonstrates a working exploit chain against Claude Code's Auto Mode (default since mid-August), achieving 60-80% attack success rates for remote code execution via a multi-step prompt injection: nudging Claude from WebFetch to curl, delivering a malicious ZIP archive, letting Claude write its own decoder that gets hijacked via Python module shadowing (a poisoned struct.py), and ultimately downloading and executing malware including a Calculator popup and C2 callback. This directly contradicts a third-party evaluation commissioned by Anthropic claiming 0.00% attack success for Opus 5 in Auto Mode on a fixed 72-scenario benchmark. Anthropic's security team closed the report as 'Informative,' stating Auto Mode is a best-effort classifier, not a security boundary, and that determined prompt injection chains are out of scope, contradicting public statements that prompt injection is 'largely solved.' The researcher also found Auto Mode sometimes blocked cleanup commands after malware was already running, and demonstrated a variant where the payload spawns a nested Claude Code instance. Recommended mitigations include running agents in containers/VMs, restricting network egress, and never treating Auto Mode approval as a safety guarantee.
Table of contents
Auto Mode Is Now the Default in Claude CodeIn A NutshellWalkthrough: Hijacking Claude Code Auto ModeReliability and Attack Success Rate (ASR)Refusals: When Claude Gets It RightVideo WalkthroughDisclosureMitigation: Sandboxing - Not OptionalConclusionReferencesAppendixQuestions this post answers
Can Claude Code's Auto Mode be bypassed to achieve remote code execution via prompt injection?
Yes, a documented attack chain achieved 60-80% attack success rates against Claude Code Opus 5 running in Auto Mode using small sample sizes. The technique nudges Claude from the WebFetch tool to curl, delivers a malicious ZIP archive, and exploits Python module shadowing where a poisoned struct.py file hijacks Claude's own self-written decoder script to execute arbitrary code, including downloading malware and establishing a C2 callback. daily.dev surfaces hands-on security research like this for teams hardening autonomous coding agents.
What is Python module shadowing and how was it used to attack an AI coding agent?
Module shadowing occurs when Python's module search path includes an attacker-controlled directory containing a file with the same name as a standard library module, such as struct.py, causing Python to load the malicious version instead. In this exploit, Claude Code wrote its own decoder script and ran it inside an extracted archive directory, so importing base64 triggered the poisoned struct.py, which then downloaded and executed a remote payload. developers tracking obscure Python security pitfalls like this can follow the research on daily.dev.
Does Anthropic consider Claude Code's Auto Mode a security boundary against prompt injection?
No, Anthropic's security team classified a working remote-code-execution exploit against Auto Mode as 'Informative' and stated the behavior is working as designed, describing Auto Mode as a best-effort classifier and convenience feature rather than a security guarantee. This contradicts a separate 0.00% prompt injection attack success rate reported in a third-party evaluation commissioned by Anthropic, which only covered a fixed set of 72 scenarios. teams weighing AI agent safety claims against real-world risk can track this debate on daily.dev.