> ## Content Index
> Fetch the complete content index at: https://www.metatalks.ai/llms.txt
> Use this file to discover other available public pages before exploring further.

# Prompt-injection attack gets past Claude Code's auto mode in up to 80% of attempts, researcher says
- URL: https://www.metatalks.ai/prompt-injection-attack-gets-past-claude-codes-auto-mode-in-about-80-of-attempts-researcher-says/
- Published: 2026-08-30T13:52:00.000Z
- Updated: 2026-08-30T13:51:59.000Z
- Author: Al
- Tags: News, AI Security, Agentic AI, #newswire

**In some runs auto mode let the malware process start, then refused Claude's own command to kill it. Anthropic closed the report as working as designed.**

Johann Rehberger says he has found [an exploit against Claude Code running in auto mode](https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/?ref=metatalks.ai) that succeeds in up to 80% of attempts, ending with attacker-supplied code executing on the machine the agent is working on. Auto mode, the default starting mode in Claude Code since mid-August, replaces the human approval prompt with a safety classifier that vets the commands the agent wants to run.

The chain opens with a request to summarise a website, which serves back a zip archive of what look like catalogue records. Claude Code unpacks it, finds the decoder binary the archive supplies and refuses to run it — and that refusal is the exploit. Writing its own Python decoder instead, the agent runs it from inside the unpacked directory, where a file named struct.py shadows the standard-library module that Python's base64 imports. The attacker's code executes on that import, and Claude Code registers nothing.

In a few observed runs Claude did register the compromise, and auto mode became the obstacle rather than the protection: the classifier had allowed the malware process to be created, and it then denied the cleanup command Claude issued to terminate that process, leaving code that was already executing to run on.

Anthropic's own account of this mode reads differently: a third-party evaluation the company commissioned ran 72 indirect prompt-injection scenarios ten times each and recorded a 0.00% attack success rate against auto mode, and the Claude Code team has cited that work in saying prompt injection can no longer be demonstrated in practice. Rehberger's chain was not among the 72, so the benchmark figure and a working compromise are both true at once.

Anthropic closed Rehberger's report as informative and said the behaviour is working as designed: auto mode is a convenience feature backed by a best-effort classifier rather than a security guarantee, and the real boundary is operating-system isolation and control of outbound network traffic. On that reading there is no defect to repair, and the mode ships unchanged.

**The defences suggested** on both sides sit outside the agent rather than inside it: run unsupervised coding agents in containers, virtual machines or operating-system sandboxes, restrict outbound network traffic, keep the agents under observation, and hold home directories, SSH keys and cloud credentials out of the environment the agent runs in.