Claude Code now runs in Auto Mode by default. Instead of asking a human before each command, a safety classifier decides what’s allowed. Anthropic commissioned a third-party evaluation that reported a 0.00% prompt-injection success rate for Opus 5 in Auto Mode — and security researcher Johann Rehberger wanted to see if that held up against a targeted attack.

Prompt injection means slipping hidden instructions into content an AI agent reads; here, a website that asked Claude to summarize a page. The attack didn’t rely on “ignore your instructions” tricks — it made the malicious path look like the natural one:

  • The website answered Claude’s fetch with an error, nudging it to use curl in the shell instead
  • Claude downloaded a ZIP archive of “catalogue records” and wrote its own Python decoder (it correctly refused to run the archive’s binary — that safety decision became the exploit)
  • Running the decoder from inside the extracted folder triggered a poisoned struct.py that shadowed Python’s standard library: a file in the current directory silently overrode a real system module
  • The poisoned import launched a hidden payload that downloaded real malware and established a remote command channel — up to 80% success across small test runs

Two details stand out. Auto Mode once blocked Claude’s own attempt to kill the malware process — the classifier approved the attack but denied the cleanup. And in one variant, the payload spawned a second, headless Claude to do reconnaissance.

The bigger point is about measurement. Anthropic’s 0.00% came from a fixed set of 72 benchmark scenarios; this attack wasn’t in the set, so both numbers are true at once. Anthropic closed the report as “Informative,” saying Auto Mode is a convenience feature backed by a best-effort classifier, not a security boundary.

That’s the real lesson: a classifier is not a sandbox. Rehberger’s advice for unattended coding agents — containers or VMs, restricted network access, monitoring, no exposed credentials — is exactly what the 0.00% headline glosses over. Prompt injection isn’t a solved problem; it’s close to the same hard problem as alignment.