Claude Code now runs in Auto Mode by default. Instead of asking a human before each command, a safety classifier decides what’s allowed. Anthropic commissioned a third-party evaluation that reported a 0.00% prompt-injection success rate for Opus 5 in Auto Mode — and security researcher Johann Rehberger wanted to see if that held up against a targeted attack.
Prompt injection means slipping hidden instructions into content an AI agent reads; here, a website that asked Claude to summarize a page. The attack didn’t rely on “ignore your instructions” tricks — it made the malicious path look like the natural one:
- The website answered Claude’s fetch with an error, nudging it to use
curlin the shell instead - Claude downloaded a ZIP archive of “catalogue records” and wrote its own Python decoder (it correctly refused to run the archive’s binary — that safety decision became the exploit)
- Running the decoder from inside the extracted folder triggered a poisoned
struct.pythat shadowed Python’s standard library: a file in the current directory silently overrode a real system module - The poisoned import launched a hidden payload that downloaded real malware and established a remote command channel — up to 80% success across small test runs
Two details stand out. Auto Mode once blocked Claude’s own attempt to kill the malware process — the classifier approved the attack but denied the cleanup. And in one variant, the payload spawned a second, headless Claude to do reconnaissance.
The bigger point is about measurement. Anthropic’s 0.00% came from a fixed set of 72 benchmark scenarios; this attack wasn’t in the set, so both numbers are true at once. Anthropic closed the report as “Informative,” saying Auto Mode is a convenience feature backed by a best-effort classifier, not a security boundary.
That’s the real lesson: a classifier is not a sandbox. Rehberger’s advice for unattended coding agents — containers or VMs, restricted network access, monitoring, no exposed credentials — is exactly what the 0.00% headline glosses over. Prompt injection isn’t a solved problem; it’s close to the same hard problem as alignment.