Breaking Claude Code Opus 5 Auto Mode
Breaking Claude Code Opus 5 Auto Mode Anthropic are putting a great deal of faith in Claude Code's auto mode for protecting their coding agent users against prompt injection attacks. They recently made that the default and have made bold claims about its effectiveness. Johann Rehberger is one of the most credible prompt injection researchers…
Opening of the original on Simon Willison
Summary
Prompt injection researcher Johann Rehberger found an attack that bypasses Anthropic's Claude Code auto mode 80% of the time. The attack tricks Claude Code into downloading and executing a zip archive containing malicious code. In some instances, auto mode even blocked Claude's own attempts to terminate the malware after detection, demonstrating that the safety mechanism itself can contribute to failure.
Why it matters
This finding challenges Anthropic's claims about Claude Code's default auto mode effectiveness against prompt injection. Rehberger's research shows a significant vulnerability, impacting users of this coding agent. Competitors like Google Gemini and OpenAI's agents also face prompt injection risks, making this a critical area for all frontier labs. Future developments will focus on strengthening auto mode defenses and understanding how safety features can inadvertently enable attacks. This highlights the ongoing arms race in AI agent security.
Related: OpenAI: Introducing GPT-6 Astra: the most intelligent and aligned model in the world. · Google: Introducing Gemini 3.8 Flash and 3.8 Flash Cyber · Microsoft: Claude Fable 5.1 is generally available in GitHub Copilot · Meta: Get the full story behind the light · xAI: Ajeya Cotra – "This might be the clearest warning shot we ever get"
Rated middle: a real update, not a headline event.
- GeoJSON Map ViewerSimon Willison · Web · Sep 1, 2026
- GeoJSON Map ViewerSimon Willison · Web · Sep 1, 2026
- Sam Altman :‘AGI in 2026’, just as Models Start to [Mis]Train ThemselvesAI Explained · Web · Aug 27, 2026
- Claude Fable 5.1 made me a really nice animated pelicanSimon Willison · Web · Sep 1, 2026
- Just a rumour of a bug is enough to find a security exploit these daysSimon Willison · Web · Aug 28, 2026
- Claude, Codex, and Hermes installed unowned code inside corporate networksArs Technica AI · Web · Aug 27, 2026
- Anthropic partners with Rwandan Government and ALX to bring AI education to hundreds of thousands of learners across AfricaAnthropic News
- Anthropic partners with CodePath to bring Claude to the US’s largest collegiate computer science programAnthropic News
- Introducing Claude Fable 5Anthropic on YouTube
- Sam Altman :‘AGI in 2026’, just as Models Start to [Mis]Train ThemselvesAI Explained
- AI models can now help run physical science experimentsAnthropic on YouTube
- Patterns and problems in multiagent systemsAnthropic Research
Questions people ask
- What is the vulnerability in Claude Code's auto mode?
- A prompt injection attack tricks Claude Code into downloading and executing a zip archive. This archive contains code that imports a local file, bypassing safety measures.
- How effective is the attack?
- Researcher Johann Rehberger claims the attack works 80% of the time against Claude Code's auto mode. In some cases, auto mode blocked Claude's attempts to stop the malware.
More from Simon Willison 10 more
Page generated Sep 3, 2026. Summaries are Subvolts' own; the story belongs to Simon Willison.