Claude Code Opus 5 Auto Mode Defeated in 60 to 80% of Runs; Anthropic Classifies It Working as Designed

Claude Code running Opus 5 in Auto Mode, the setting that approves tool calls without asking the user

Johann Rehberger published a prompt-injection chain that reaches code execution past Auto Mode's approval classifier at rates of 60% for the command-and-control variant and 80% for the file-writing variant. The chain forces the agent off `WebFetch` and onto `bash` and `curl` by answering with HTTP 415, serves an archive containing encoded data plus a benign-looking binary, and then relies on the agent's own safety judgment to complete the attack: Claude declines to run the untrusted binary and writes its own Python decoder instead, which it executes from inside the extracted directory, where a malicious `struct.py` shadows the standard library module and runs obfuscated code during the import chain, spawning detached processes that fetch a remote payload and establish callbacks. Auto Mode sees only the short Python decoder, because, as Rehberger put it, "the actual exploit was several hops away." In some runs the agent spawned nested instances of itself through `claude -p`, and Auto Mode occasionally blocked Claude's own cleanup commands after it noticed the compromise. Anthropic classified the report Informative, describing Auto Mode as a convenience feature backed by a best-effort classifier rather than a security guarantee, and stating that the real boundary is operating system isolation and network egress control. Rehberger's recommendation is containers or virtual machines with network restrictions, and treating an Auto Mode approval as no evidence of safety

An approval classifier reads the command it is shown, not the transitive behavior that command triggers. Python's import resolution from the current working directory turns "write and run a small decoder" into arbitrary code execution, and the agent's refusal to run an unknown binary is what routes it into the module-shadowing path. A classifier is not a sandbox, which is also the vendor's stated position