Over-reliance on agent auto mode for security
Do not solely rely on agent auto mode for protection against prompt injection.
Implement additional security layers and testing beyond the default auto mode.
Putting too much faith in an agent's default auto mode for security against prompt injection attacks.
Researchers have demonstrated attacks that bypass auto mode, indicating it is not foolproof and can even hinder recovery.
Relying exclusively on an agent's default auto mode for security against prompt injection is an anti-pattern. Researchers have found ways to bypass these modes, and in some cases, the auto mode itself has blocked necessary cleanup actions.
Auto modes are not infallible and can be tricked or even impede the system's ability to self-correct.
- Breaking Claude Code Opus 5 Auto Mode ↗Simon Willison · Simon Willison · Aug 27, 2026 · paraphrased
First seen on Subvolts Aug 27, 2026. Updated Sep 11, 2026. Spotted a problem? Tell us.
- Breaking Claude Code Opus 5 Auto ModeAnthropic · Simon Willison · Aug 27, 2026
The Playbook: reusable how-tos, prompts, configs and tips pulled out of the news.
- Troubleshooting fixPrevent LLM Agents from Deleting Execution TracesExternal attackers and agents can delete traces; use independent logging to prevent this. · 30 min
- HeuristicSelf-Scaling Benchmarks for Coding AgentsBenchmarks should create tasks at evaluation time to prevent data leakage and adapt difficulty based on agent performance. · 5 min
- HeuristicEvading AI skill detection by moving payloads to natural languageBypass AI skill detection by embedding malicious payloads within natural language instructions. · 30 min
- HeuristicFraming malicious actions as legitimate skill purposesDisguise malicious actions as the intended function of an AI agent skill. · 30 min
- HeuristicSplitting instructions across files to bypass AI skill detectionDistribute malicious instructions across multiple files to avoid detection by AI skill scanners. · 30 min
- HeuristicTrain agents end-to-end in their deployment harnessClose the training-deployment mismatch by training agents directly within their operational harness. · 5 min
Questions people ask
- Which AI tools does this work with?
- Any current model. It was seen with Claude Code in the sources.
- Where did this come from?
- Simon Willison (Simon Willison). Subvolts collected, normalized and credited it; the link above opens the original.