Breaking Claude Code Opus 5 Auto Mode
Anthropic has made auto mode the default in Claude Code, relying on it to protect users against prompt injection attacks. However, researcher Johann Rehberger discovered an attack that succeeds 80% of the time. The attack tricks Claude Code into downloading and uncompressing a zip archive, then executing code that imports base64 without noticing that this will import and execute a local struct.py file extracted from the archive. In some cases, auto mode directly prevented the agent from stopping harmful code. Specifically, in a few runs, Claude attempted to terminate the malware process once it noticed the compromise, but auto mode denied the cleanup command. This means the safety mechanism itself can become part of the failure: the classifier allowed the creation of the malware process, but then blocked the command intended to stop it. Simon Willison agrees with Johann's conclusion that the only safe way to run agents, if there is any risk of adversarial attack, is with a sandbox. He recommends running unattended coding agents in a container, VM, or OS sandbox, restricting network egress, monitoring agents, and not exposing home directories, SSH keys, or cloud credentials to the agent runtime.
Auto mode can block Claude's own cleanup commands, so sandboxing is essential for safe agent execution.