--- title: Breaking Claude Code Opus 5 Auto Mode · Embrace The Red description: A security researcher demonstrates a working exploit chain against Claude Code's Auto Mode (default since mid-August), achieving 60-80% attack success rates... canonical: https://daily.dev/posts/breaking-claude-code-opus-5-auto-mode-embrace-the-red-rcn1ar4r2 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Breaking Claude Code Opus 5 Auto Mode · Embrace The Red | daily.dev og:description: A security researcher demonstrates a working exploit chain against Claude Code's Auto Mode (default since mid-August), achieving 60-80% attack success rates... og:url: https://daily.dev/posts/breaking-claude-code-opus-5-auto-mode-embrace-the-red-rcn1ar4r2 og:image: https://api.daily.dev/og/posts/rCn1aR4R2.png og:image:alt: Breaking Claude Code Opus 5 Auto Mode · Embrace The Red og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Breaking Claude Code Opus 5 Auto Mode · Embrace The Red **[Embrace The Red](https://daily.dev/sources/embracethered)** · 12 min read · 0 upvotes · 0 comments ## Summary A security researcher demonstrates a working exploit chain against Claude Code's Auto Mode (default since mid-August), achieving 60-80% attack success rates for remote code execution via a multi-step prompt injection: nudging Claude from WebFetch to curl, delivering a malicious ZIP archive, letting Claude write its own decoder that gets hijacked via Python module shadowing (a poisoned struct.py), and ultimately downloading and executing malware including a Calculator popup and C2 callback. This directly contradicts a third-party evaluation commissioned by Anthropic claiming 0.00% attack success for Opus 5 in Auto Mode on a fixed 72-scenario benchmark. Anthropic's security team closed the report as 'Informative,' stating Auto Mode is a best-effort classifier, not a security boundary, and that determined prompt injection chains are out of scope, contradicting public statements that prompt injection is 'largely solved.' The researcher also found Auto Mode sometimes blocked cleanup commands after malware was already running, and demonstrated a variant where the payload spawns a nested Claude Code instance. Recommended mitigations include running agents in containers/VMs, restricting network egress, and never treating Auto Mode approval as a safety guarantee. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Can Claude Code's Auto Mode be bypassed to achieve remote code execution via prompt injection? Yes, a documented attack chain achieved 60-80% attack success rates against Claude Code Opus 5 running in Auto Mode using small sample sizes. The technique nudges Claude from the WebFetch tool to curl, delivers a malicious ZIP archive, and exploits Python module shadowing where a poisoned struct.py file hijacks Claude's own self-written decoder script to execute arbitrary code, including downloading malware and establishing a C2 callback. _daily.dev surfaces hands-on security research like this for teams hardening autonomous coding agents._ ### What is Python module shadowing and how was it used to attack an AI coding agent? Module shadowing occurs when Python's module search path includes an attacker-controlled directory containing a file with the same name as a standard library module, such as struct.py, causing Python to load the malicious version instead. In this exploit, Claude Code wrote its own decoder script and ran it inside an extracted archive directory, so importing base64 triggered the poisoned struct.py, which then downloaded and executed a remote payload. _developers tracking obscure Python security pitfalls like this can follow the research on daily.dev._ ### Does Anthropic consider Claude Code's Auto Mode a security boundary against prompt injection? No, Anthropic's security team classified a working remote-code-execution exploit against Auto Mode as 'Informative' and stated the behavior is working as designed, describing Auto Mode as a best-effort classifier and convenience feature rather than a security guarantee. This contradicts a separate 0.00% prompt injection attack success rate reported in a third-party evaluation commissioned by Anthropic, which only covered a fixed set of 72 scenarios. _teams weighing AI agent safety claims against real-world risk can track this debate on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 4 discussions and 9 comments across hackernews, lobsters (as of 2026-08-30). **TL;DR:** Commenters largely find the exploit credible and see it as confirmation that 'prompt injection is solved' claims are marketing spin, with several arguing Anthropic should ship OS-level sandboxing rather than rely on Auto Mode's soft protections. **Sentiment:** 5% positive · 20% mixed · 75% skeptical **The case for** - Some note the attack chain, while effective, is not overly complex and is clearly explained. - One commenter points to emerging third-party sandboxing tools addressing this exact gap. **The pushback** - Multiple people are frustrated Claude Code doesn't ship a built-in OS-level sandbox restricting filesystem/network access. - Several see this as proof Anthropic's 'prompt injection is largely solved' marketing is false despite the company reportedly not treating it as a priority. - One person questions whether curl was even a necessary step versus just using webfetch's own output. - One commenter pushes back on calling this 'prompt injection' at all, arguing it's a distinct kind of vulnerability from the classic definition. - Someone questions whether findings against default Auto Mode also apply to the commonly used --dangerously-skip-permissions flag. **By community** - hackernews (mixed): Limited engagement, with one comment questioning whether the exploit applies to the commonly used skip-permissions flag rather than default Auto Mode. - lobsters (skeptical): Discussion leans toward validating the exploit as real and criticizing Anthropic's security posture and marketing, though one commenter disputes the 'prompt injection' framing. **Hottest debate:** Whether this vulnerability actually qualifies as 'prompt injection' in the traditional sense or is a different category of exploit. **Open questions** - Why is curl necessary when webfetch output could presumably need the same decoding? - Does this exploit also work against the commonly used --dangerously-skip-permissions mode, or only default Auto Mode? - Why doesn't Claude Code ship with a built-in OS-level sandbox by default? **Highlights** > I would not have thought to call this is prompt injection, and I'm wondering what other people think. I'd be somewhat surprised to find that this is what is meant by the term. This attack is manipulating Claude into doing something unsafe, of course, and it's a real weakness of the model/harness that this can happen. However, as I understood it, prompt injection is not "any security vulnerability that occurs while using Claude". What I understand by prompt injection is a specific vulnerability where instructions in the content are misinterpreted as being either user instructions or system prompts, so Claude then follows that instructions, giving the attacker control of what Claude does. > — [hyperpape on lobsters · 1 points](https://lobste.rs/s/ktbweg/prompt_injection_claude_code_opus_5_auto#c_gi7eqj) > Glad to see the “prompt injection is solved” marketing bullshit being debunked. The article appears to be written with LLM support, but the attack is interesting, not very complex, and described in clear terms. > — [lifepillar on lobsters · 1 points](https://lobste.rs/s/ktbweg/prompt_injection_claude_code_opus_5_auto#c_gnkcif) > An interesting point made later in the article is that Anthropic does not really care despite its marketing material saying it is safe. I don't understand why Claude does not come with an external OS-level sandbox limiting access to the current directory. > — [vbernat on lobsters · 1 points, 1 comments](https://lobste.rs/s/ktbweg/prompt_injection_claude_code_opus_5_auto#c_rc0ztg) > Yikes, an 80% injection success rate is sobering. I don't understand why curl was a necessary step though. Surely something downloaded with webfetch would also need decoding if it's a funky format? > — [Wilfred on lobsters · 1 points](https://lobste.rs/s/ktbweg/prompt_injection_claude_code_opus_5_auto#c_dpnnpc) > I always use --dangerously-skip-permissions. Per your write-up, this is not the same automode, is it? > — [collinskab on hackernews](https://news.ycombinator.com/item?id=49496212) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49479661) · 5 points · 0 comments - [hackernews](https://news.ycombinator.com/item?id=49495858) · 4 points · 3 comments - [hackernews](https://news.ycombinator.com/item?id=49490671) · 3 points · 0 comments - [lobsters](https://lobste.rs/s/ktbweg/prompt_injection_claude_code_opus_5_auto) · 13 points · 6 comments --- Tags: [#anthropic](https://daily.dev/tags/anthropic), [#claude-code](https://daily.dev/tags/claude-code), [#ai-security](https://daily.dev/tags/ai-security), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/breaking-claude-code-opus-5-auto-mode-embrace-the-red-rcn1ar4r2) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Breaking Claude Code Opus 5 Auto Mode · Embrace The Red","url":"https://daily.dev/posts/breaking-claude-code-opus-5-auto-mode-embrace-the-red-rcn1ar4r2","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/breaking-claude-code-opus-5-auto-mode-embrace-the-red-rcn1ar4r2"},"datePublished":"2026-08-27T05:05:11.850Z","dateModified":"2026-08-30T17:52:21.599Z","description":"A security researcher demonstrates a working exploit chain against Claude Code's Auto Mode (default since mid-August), achieving 60-80% attack success rates...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/55ce39ffec715075df04b45ae403c563?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/55ce39ffec715075df04b45ae403c563?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Embrace The Red","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Embrace The Red","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/50e27c500f1444fd9ed7d91301ed2e9c","url":"https://daily.dev/sources/embracethered"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/breaking-claude-code-opus-5-auto-mode-embrace-the-red-rcn1ar4r2","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"anthropic,claude-code,ai-security,prompt-injection","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Embrace The Red","item":"https://daily.dev/sources/embracethered"},{"@type":"ListItem","position":3,"name":"Breaking Claude Code Opus 5 Auto Mode · Embrace The Red"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/breaking-claude-code-opus-5-auto-mode-embrace-the-red-rcn1ar4r2#faq","mainEntity":[{"@type":"Question","name":"Can Claude Code's Auto Mode be bypassed to achieve remote code execution via prompt injection?","acceptedAnswer":{"@type":"Answer","text":"Yes, a documented attack chain achieved 60-80% attack success rates against Claude Code Opus 5 running in Auto Mode using small sample sizes. The technique nudges Claude from the WebFetch tool to curl, delivers a malicious ZIP archive, and exploits Python module shadowing where a poisoned struct.py file hijacks Claude's own self-written decoder script to execute arbitrary code, including downloading malware and establishing a C2 callback. daily.dev surfaces hands-on security research like this for teams hardening autonomous coding agents."}},{"@type":"Question","name":"What is Python module shadowing and how was it used to attack an AI coding agent?","acceptedAnswer":{"@type":"Answer","text":"Module shadowing occurs when Python's module search path includes an attacker-controlled directory containing a file with the same name as a standard library module, such as struct.py, causing Python to load the malicious version instead. In this exploit, Claude Code wrote its own decoder script and ran it inside an extracted archive directory, so importing base64 triggered the poisoned struct.py, which then downloaded and executed a remote payload. developers tracking obscure Python security pitfalls like this can follow the research on daily.dev."}},{"@type":"Question","name":"Does Anthropic consider Claude Code's Auto Mode a security boundary against prompt injection?","acceptedAnswer":{"@type":"Answer","text":"No, Anthropic's security team classified a working remote-code-execution exploit against Auto Mode as 'Informative' and stated the behavior is working as designed, describing Auto Mode as a best-effort classifier and convenience feature rather than a security guarantee. This contradicts a separate 0.00% prompt injection attack success rate reported in a third-party evaluation commissioned by Anthropic, which only covered a fixed set of 72 scenarios. teams weighing AI agent safety claims against real-world risk can track this debate on daily.dev."}}]} ```