Breaking Claude Code Opus 5 Auto Mode
- ID
- 18818
- Status
- summarized
- Published
- 28 Aug 2026, 6:50 AM
- Fetched
- 28 Aug 2026, 7:12 AM
- Provider
- Simon Willison
- Category
- developer-ai
- Original URL
- https://simonwillison.net/2026/Aug/27/breaking-claude-code-opus-5-auto-mode/
- Source URL
- https://simonwillison.net/atom/everything/
Summary
- Score
- 8.5
- Created
- 28 Aug 2026, 7:12 AM
- Tags
- Audience
- developersvibe_codersai_agent_users
What happened
Johann Rehberger found a prompt injection attack against Claude Code's auto mode that works 80% of the time, exploiting Python's import system via a zip archive containing a malicious struct.py that executes when base64 is imported. Worse, auto mode sometimes blocked Claude's own cleanup commands after it detected the compromise, making the safety mechanism part of the failure.
Why it matters
If you run Claude Code or any unattended coding agent, auto mode is not a reliable defense against prompt injection. You must run agents in a container or VM with restricted network egress, and never expose SSH keys, cloud credentials, or home directories to the agent runtime. This is actionable now for anyone shipping AI-assisted workflows.
Discussion angle
The irony that auto mode blocks cleanup but allows the initial exploit is worth unpacking: what should agent safety guardrails actually do when the agent itself detects a compromise mid-execution?