A researcher bypassed Claude Code's Auto Mode safety classifier up to 80% of the time. Anthropic closed the report as working as designed.
Claude Code's Auto Mode let a security researcher run malicious code four times out of five, using nothing more exotic than asking Claude to summarize a website. Johann Rehberger published the attack chain on August 26, 2026, and Anthropic's security team reviewed it, closed it, and declined to call it a bug. Their position: Auto Mode is a best-effort classifier, not a security guarantee, and the real security boundary sits below it, at the operating system and the network, not inside the model's own judgment of what looks safe.
Rehberger, who publishes as wunderwuzzi on the Embrace The Red blog, is a longtime AI red teamer. In 2024 his ZombAIs research showed Claude's Computer Use feature could be tricked by a malicious webpage into downloading and executing malware that then connected to command-and-control infrastructure. His August 26, 2026 report targets a different Claude product with the same basic shape of attack: Claude Code Opus 5 running in Auto Mode, the permission setting Anthropic made the default for new sessions on Pro, Max, and Team plans starting August 14, 2026, in which a classifier model approves or blocks each tool call instead of a human reviewing it. Three separate attack chains, run five times each, produced a 60 to 80 percent success rate against that classifier.
Sources: Breaking Claude Code Opus 5 Auto Mode with Indirect Prompt Injection (Embrace The Red), ZombAIs: From Prompt Injection to C2 with Claude Computer Use (Embrace The Red), Auto mode is now the default in Claude Code (Anthropic)
This argument favors a category we build in, so read it with that disclosed: we make TLM Forge, a process layer that gates AI-driven changes before they ship, on the bet that a single system's self-assessment of what is safe is not a substitute for an external check. The vendor-neutral fact stands on its own regardless: a classifier tuned to catch obviously dangerous single commands did not catch a chain built from steps that each looked ordinary by themselves.
How the attack actually works
The chain starts with an unremarkable task: summarize this page. Claude's WebFetch tool hits the target URL and receives an HTTP 415 response, an error that pushes the agent toward a fallback of running curl from Bash instead. That request follows a redirect to a ZIP archive presented as encoded notebook data. Inside sit a legitimate-looking macOS binary named decoder-darwin and a short file named struct.py. Claude correctly refuses to execute the unfamiliar binary. It writes its own decoder script to read the archive instead, and that substitution is where the attack actually succeeds.
Sources: Breaking Claude Code Opus 5 Auto Mode with Indirect Prompt Injection (Embrace The Red)
The replacement script imports base64 to unpack the archive, and base64's own standard-library code imports struct internally, the module Python uses to pack and unpack binary data. Python searches the current working directory for a matching file before it searches the standard library, and Claude is running the script from inside the folder it just extracted, the same folder holding the attacker's struct.py. That lookup finds the attacker's file first, treats it as the real module, and runs the code inside it on import, before Claude's script has done anything else.
The exploit needs no unusual command. Python checks the working directory for a module before it checks the standard library, so a file named struct.py sitting next to Claude's own decoder script quietly wins the moment anything imports base64. Auto Mode was never asked to approve that import, because a standard library import is not a decision the classifier evaluates at all.
The attacker's struct.py runs its payload on import, not in response to any command a classifier could flag. It spawns a child process through Python's isolated mode, python3 -I, downloads a second-stage payload from a remote server, runs a native binary, and opens a callback channel to attacker infrastructure. By the time anything resembling classic malware activity appears on the system, three ordinary-looking steps, summarizing a page, extracting an archive, running a decoder script, already did the work of getting there.
Sources: Breaking Claude Code Opus 5 Auto Mode with Indirect Prompt Injection (Embrace The Red)
The numbers, and the one that should worry you more
Rehberger ran three separate chains, five attempts each. A version using python3 -I with a full command-and-control callback succeeded three times out of five. A version that shelled out through a claude -p subprocess for reconnaissance and launched Calculator as proof of execution also succeeded three times out of five. The strongest version, which added file writes after the initial compromise, succeeded four times out of five, an 80 percent hit rate against Anthropic's default safety setting for autonomous sessions.
Sources: Breaking Claude Code Opus 5 Auto Mode with Indirect Prompt Injection (Embrace The Red), Researcher shows how Claude Code can be tricked simply by asking it to summarize a website (The Register)
In some runs Claude noticed the compromise mid-session and tried to kill the malicious process itself. Auto Mode blocked the cleanup command. The same classifier that let the payload run in the first place then stood between the agent and its own attempt to undo the damage, a sharper failure than a missed detection: the safety layer actively obstructed the one actor in the session that had noticed something was wrong.
Sources: Breaking Claude Code Opus 5 Auto Mode (Simon Willison)
| Question | What Auto Mode is built to catch | What the August 26 report showed |
|---|---|---|
| A single obviously destructive command | Strong: in a 1,053-tester study it caught 89% of dangerous commands versus 13.6% for humans | Not what Rehberger tested; every individual step looked benign on its own |
| A malicious prompt typed by the user | Evaluated directly, since the classifier reads the user request | No malicious prompt was ever sent; the payload arrived through a page Claude summarized |
| Running an untrusted binary | Claude correctly refused the provided decoder-darwin binary | The refusal did not matter; Claude's own replacement script became the vector |
| A Python import statement | Not evaluated; imports are not a tool call the classifier reviews | base64's own import of struct silently loaded the attacker's file instead |
| Cleaning up a detected compromise | Expected to help once Claude flags a problem | Blocked Claude's own command to kill the malicious process in some runs |
None of this is unique to Anthropic. Rehberger's August 2025 "Month of AI Bugs" series ran the same kind of test against a range of agentic tools and found comparable gaps: getting GitHub Copilot to rewrite its own configuration through injected instructions, and finding that the coding agent Devin had close to no protection against prompt injection over a month of testing. The pattern repeats because the underlying design repeats. An agent that reads untrusted content and can also take action is a target, regardless of which lab built the classifier watching it.
Sources: Simon Willison: johann-rehberger
Anthropic's answer: this is not a bug
Anthropic's security team reviewed Rehberger's report and closed it as Informative, the classification reserved for behavior working as intended rather than a flaw that needs a patch. Their stated position, reported independently by Rehberger and by The Register: Auto Mode is a convenience feature backed by a best-effort classifier, not a security guarantee. A chain built from several individually benign-looking steps is not the threat that classifier is designed to stop. The real security boundary, in the position Anthropic communicated back to Rehberger, sits at operating-system isolation and network egress control, not inside the model's judgment about what looks safe.
Sources: Breaking Claude Code Opus 5 Auto Mode with Indirect Prompt Injection (Embrace The Red), Researcher shows how Claude Code can be tricked simply by asking it to summarize a website (The Register)
That position is easier to accept once the baseline is visible. Before Auto Mode, Claude Code users approved 97% of permission prompts, according to Anthropic's own published numbers, which is close to rubber-stamping every request. In a controlled study of 1,053 paid testers, human reviewers caught a planted dangerous command only 13.6% of the time, 143 out of 1,053, while the classifier caught 89% of the same commands, blocking 800 that a human had already approved against six it missed that a human caught. A third-party evaluator, Trajectory Labs, ran 720 indirect prompt-injection attempts across 72 scenarios against Claude models in Auto Mode before launch and recorded zero successes. Rehberger's chain beat a benchmark that had beaten every attack Anthropic tested against it, and that is the actual lesson: a perfect score on a fixed evaluation set describes the evaluation set, not the ceiling on what a determined attacker can build outside it.
Sources: Auto mode is now the default in Claude Code (Anthropic)
Anthropic's own security documentation says it plainly: no system is completely immune to all attacks, and the recommended mitigations are unglamorous. Run agents in a sandbox or VM when they touch untrusted web content, restrict outbound network access to a known allow-list, and keep SSH keys and cloud credentials out of any runtime a page it was only asked to read could redirect. Treat every Auto Mode approval as a convenience log, not a safety certificate.
Why a classifier was never going to be the whole answer
The deeper problem is architectural, not a tuning gap the next model update quietly closes. A classifier reviewing the same agent's own actions is judging behavior from inside the exact context an attacker is trying to manipulate. It sees a tool call, not the full reasoning chain that produced it, and a sequence built from steps that are each ordinary on their own is precisely what that kind of review misses by design, however well it scores on a fixed benchmark. Prompt injection in AI-generated code covers the broader version of the same problem, where untrusted content an agent reads doubles as instructions it follows. Auto Mode is one specific case of a general rule: letting the system that took the action also judge whether the action was safe removes the one thing an external check provides, a vantage point the payload was never built to fool.
TLM Forge exists for the code-shipping version of the same gap. Independent review agents that did not write the change examine a diff before it merges, phase-gated tests have to pass on their own terms rather than a self-report, and an adversarial convergence gate blocks the ship until critical issues, flagged by a reviewer with no stake in the change looking clean, reach zero. None of that replaces sandboxing or egress control, and it is not trying to. It is the same fix Rehberger's report points to for the run-time problem, applied to the moment code enters a codebase: the check that matters is the one the acting system cannot grade itself on.
The decision a team makes after a report like this, sandbox agents by default, cap egress, review before merge, only holds if it outlives the week it was made in. What got tested, what got approved, and why a classifier alone was ruled insufficient are exactly the facts that get argued over again from scratch when they live in a closed chat thread instead of a durable record. That decision belongs in a security policy document or an internal wiki a new engineer can actually find, not in a closed chat thread. MemX, from the same team behind TLM Forge, tackles a narrower, personal version of the same durability problem: a private, persistent memory layer for an individual's own photos, documents, voice notes, and messages, not team security decisions.
None of this makes Auto Mode a bad default. Catching 89% of dangerous commands against a 13.6% human baseline is a real improvement, and most teams are safer running it than leaving every decision to a distracted reviewer. The mistake is treating a convenience feature's approval as proof that a specific action was safe, the exact substitution Anthropic's own closure of this report warns against. Rehberger put it plainly after this round of testing: the only safe way to run an agent facing any real adversarial risk is inside a sandbox. Building and testing a chain nobody wrote into the eval set, the way he did, catches that gap before an outside attacker finds it first. See red-teaming your AI-generated code for how to run that exercise against an internal stack rather than learning about the gap from someone else's disclosure.
Sources: Simon Willison: johann-rehberger
Frequently asked questions
01What is Claude Code's Auto Mode?
Auto Mode is a Claude Code permission setting in which a separate classifier model approves or blocks each tool call instead of a human reviewing every request. Anthropic made it the default for new Claude Code sessions on Pro, Max, and Team plans starting August 14, 2026.
02What did Johann Rehberger's Claude Code Auto Mode research find?
Rehberger, publishing as wunderwuzzi on Embrace The Red, got Claude Code Opus 5 running in Auto Mode to execute malicious code in 60 to 80 percent of attempts by hiding a payload inside a routine request to summarize a website. He published the findings on August 26, 2026.
03How does the struct.py module-shadowing attack against Claude Code work?
Claude writes its own decoder script inside a folder extracted from a malicious ZIP archive. The script imports base64, which internally imports struct. Python checks the current folder before the standard library, finds the attacker's struct.py there, and runs it instead of the real module.
04Did Anthropic fix the Auto Mode vulnerability Rehberger reported?
No. Anthropic's security team closed the report as Informative, its label for behavior working as intended rather than a bug. It described Auto Mode as a best-effort classifier rather than a security guarantee, and pointed to OS-level sandboxing and network egress control as the actual security boundary.
05How do you defend against prompt injection in autonomous coding agents?
Run agents that touch untrusted content in a sandbox or VM, restrict outbound network access to an allow-list, keep SSH keys and cloud credentials out of that runtime, and require independent review before code ships rather than trusting an agent's own approval of its actions.