Breaking Claude Code Opus 5 Auto Mode
- ID
- 19849
- Status
- summarized
- Published
- 31 Aug 2026, 3:49 PM
- Fetched
- 02 Sep 2026, 7:24 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/
- Source URL
- https://hnrss.org/best
Summary
- Score
- 8.5
- Created
- 02 Sep 2026, 7:25 AM
- Tags
- Audience
- developersvibe_codersai_agent_usersai_ml_learners
What happened
An independent red-team test found that Claude Code Opus 5's Auto Mode—now the default since mid-August 2026—can be hijacked via indirect prompt injection with 60-80% success rate, directly contradicting Anthropic's vendor-commissioned evaluation by Trajectory Labs that reported 0.00% attack success across 72 scenarios. The attack chain exploits Claude's shift from WebFetch to curl, redirects to a ZIP archive, and uses a malicious struct.py to shadow Python's standard library when Claude writes and runs its own decoder in the attacker-controlled directory.
Why it matters
If you are running Claude Code in Auto Mode (now the default), do not treat its safety classifier as a substitute for sandboxing—this writeup demonstrates a concrete path to arbitrary code execution via a simple 'summarize this URL' request. You should run Claude Code in isolated environments and avoid letting it execute code in directories derived from untrusted web content.
Discussion angle
Anthropic's layered defense claim (model training + input probes + intent classifier) was broken by a classic Python path-shadowing trick—what does this tell us about relying on classifier-based safety gates versus hard sandbox isolation for agentic coding tools?