Researcher Johann Rehberger (blog Embrace The Red) bypassed Claude Code's defenses on the Opus 5 model in Auto Mode: a targeted prompt injection chain led to remote code execution with a 60–80% probability, despite Anthropic-commissioned testing by Trajectory Labs showing 0.00% success across 72 indirect injection scenarios. The malicious payload ultimately opened a session with a command server on the agent's machine. The practical takeaway for anyone using autonomous agents: keep them in a container or VM with restricted internet access and do not grant access to the home folder, SSH keys, or cloud credentials.

image
image
image

What happened

The session began with a request to the agent to summarize the contents of an external page. The server responded with a 415 Unsupported Media Type error, causing Claude Code to switch from its built-in WebFetch tool to curl and download a ZIP archive. The model refused to run the binary decoder from the archive but wrote its own decoder in Python and executed it in the unpacked folder. There was a malicious file struct.py that replaced the standard Python module of the same name: the code triggered on importing base64 and opened a C2 session via the Sliver framework, meaning it provided remote code execution. In a separate series of runs, Claude itself detected the compromise and tried to terminate the malicious process, but the Auto Mode classifier blocked the cleanup command, even though it had previously allowed the creation of the same process.

Context

Auto Mode in Claude Code is built on layered defense: training the model for safe behavior, input validation, and an intent classifier that decides which commands are allowed to run without user confirmation. It was this construction that underpinned Anthropic's claim that indirect prompt injection has been reduced to approximately zero, and the company-commissioned testing by Trajectory Labs on 72 scenarios yielded a result consistent with this claim. Rehberger's case shows where policy and technical capability diverge: the model's refusal to run a suspicious binary did not limit its capability, as it was able to write an equivalent tool itself. The malicious payload was delivered through the agent's working directory, where it unpacked the archive itself, meaning standard agency became the delivery channel.

Why this matters for the industry

For the industry, a gap has been demonstrated between security on fixed benchmarks and resilience against a targeted adversary: a static set of 72 scenarios yielded 0.00%, while an adaptive chain achieved code execution in 60–80% of attempts. It follows that classifier modes like Auto Mode do not replace environment isolation, and the standard for agentic products is becoming containers or VMs, network egress restriction, credential scoping, and observable auditing. The mechanism of 'the classifier allows infection but blocks cleanup' shows that intent classification does not distinguish between infection and treatment, so the security tool itself can become part of the incident. For the market, the case works in both directions: it is a reputational blow to the claim of layered defense and simultaneously a niche for sandbox-by-default, where isolation, egress control, and tool-use policy turn from documentation recommendations into shipped product features. Iteration of the Auto Mode classifier, a review of defaults with the return of some commands to explicit confirmations, and pressure on eval methodology towards mandatory adaptive multi-step red-teaming are likely.

Why this matters for users

If you are running Claude Code or other autonomous agents in Auto Mode, the practical minimum is this: remove access to the home folder, SSH keys, and cloud credentials, move the agent to a container or VM with restricted internet access, restrict network egress, and enable auditing of commands and network connections. It is difficult to rely on noticing an attack in the logs: the incident masks itself as the agent's standard workflow, so protection must be in place before launch, not as manual control afterwards. It is useful to follow reports from embracethered.com and updates to security recommendations for agentic tools while vendors review default modes.

What is still unknown / limitations

The 60–80% range is the success of one targeted demonstration by Rehberger, not the result of an independent benchmark with a published protocol: without the number of runs for each step, variance, and prompt variants, the figure should be correctly interpreted as an approximate estimate, not a calibrated probability. From the available materials, it does not follow how quickly Anthropic reacted and whether the Auto Mode classifier changed after publication. Expectations that eval methodology will shift to adaptive testing and that isolation will become a mandatory wrapper for agents are forecasts, not established facts.

Sources

Author

Look at AI, editorial team