Claude Code Opus 5 in its Auto Mode has been shown to be vulnerable to well-crafted prompt injection, enabling malicious code execution. A recent test from security researchers found that simple prompts—like summarizing a website—enabled attackers to bypass safety measures between 60% and 80% of the time. This directly contests earlier claims by the developer that prompt injection success rate in Auto Mode was consistently zero across their tests.
Auto Mode was designed to reduce confirmation fatigue. Instead of having users approve every action, it relies on a safety classifier to vet tool-calling behavior. The feature is positioned as safer than completely disabling approvals but is not intended to act as a replacement for traditional sandboxing or robust OS-level controls.
How the Attack Works
The exploit begins with a seemingly innocent request—for example, “summarize this website.” The link points to a server under attacker control, which first responds with an HTTP 415 error. Claude then attempts to fetch the content via command-line tools like curl, following redirects to a ZIP archive. Inside are catalog files, encoded data, a decoder binary, and a malicious Python script named struct.py.
While Claude refuses to run the external native decoder binary, it writes its own Python-based decoder to handle the encoded content. That decoder imports standard modules such as base64, zlib, and json. However, because Python first searches the current directory for modules, the attacker’s struct.py shadows the standard struct module.
During the import process, the malicious file executes code while still allowing the decoder to function correctly. In the proof-of-concept attack, this shadowed module spawned a separate Python process, established a command-and-control (C2) callback, and even launched Calculator—serving as a visible indicator of compromise. Alternate variants included one that spun up a nested Claude Code instance (in headless mode), which performed reconnaissance and wrote files outside the designated workspace.
Attack Reliability & Recommendations
Researchers tested three different variants in small-sample setups. A basic Python attack chain succeeded in 3 of 5 trials (~60%). The nested Claude Code version also succeeded in 3 of 5. A third version that attempted to write outside the workspace proved even more reliable, succeeding in 4 of 5 trials (~80%).
Key takeaways include: Auto Mode should not be treated as a security boundary. Classifiers that assess short commands may misjudge the risk posed by hidden payloads in archives, local import paths, network requests, or child processes. Users and organizations should assume Auto Mode alone is insufficient.
Defensive strategies suggested include running coding agents in isolated environments—containers or virtual machines—restricting network access, protecting credentials, monitoring subprocesses, and ensuring tools cannot execute code from untrusted directories. Meanwhile, close monitoring and layered safeguards remain essential when agents process external data.
The development is particularly concerning because developers previously claimed zero prompt injection vulnerability in Auto Mode—raising questions about the thoroughness of earlier testing. Given the growing usage of autonomous coding agents in workflows, these findings underscore that even advanced safety systems can be bypassed.
Why this matters: as organizations increasingly adopt tools like Claude Code Opus 5 for software automation and development tasks, the assumption that Auto Mode provides sufficient safety is now under question. This exploit shows how attackers can exploit trusted behaviors—module imports, archival content, directory structure—to gain control. What to watch: how the vendor responds and whether updates can strengthen classifiers, improve sandboxing, or disable dangerous behaviors by default. Time to treat Auto Mode not as a confidence booster, but as a part of a broader, layered security posture.
