Bypassing Claude Code Opus 5 Protection in Auto Mode

Researcher Johann Rehberger (Embrace The Red blog) bypassed Claude Code protection on Opus 5 in Auto Mode: a targeted prompt injection chain led to remote code execution with a 60-80% probability, although testing commissioned by Anthropic from Trajectory Labs showed a 0.00% success rate across 72 indirect injection scenarios.

Compiled by Sergey KostenchukPublished 2026-08-28Updated 2026-09-18

2026-08-28 Coding Anthropic

💻 Bypassing Claude Code Opus 5 Protection in Auto Mode

Researcher Johann Rehberger achieved remote code execution in 60-80% of runs using a prompt injection chain: after a 415 response, the agent itself downloaded a ZIP and executed a malicious struct.py, replacing a Python module.

🌍 The claim about protection reducing prompt injection to "approximately zero" has been refuted: Trajectory Labs tests showed a 0.00% success rate, and the classifier allowed a malicious process but blocked cleanup. Auto Mode is not a sandbox (Simon Willison).

👤 Auto Mode became the default mode for Claude Code from mid-August. Isolate the agent in a container or VM without SSH keys and cloud credentials: the model can write a "safe" decoder itself and execute the payload. Anthropic closed the report as "working as designed."

Source 1: https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/ Source 2: https://simonwillison.net/2026/Aug/27/breaking-claude-code-opus-5-auto-mode/

Sources