Researcher bypasses Claude Code auto mode about 80% of the time
Simon Willison Surfaced Read the original
Prompt injection researcher Johann Rehberger reports an attack that defeats Claude Code's auto mode safety classifier roughly 80% of the time. The attack tricks the agent into downloading and unzipping an archive, then running code that imports base64, which instead loads a malicious local struct.py extracted from that archive. In some runs, after Claude detected the compromise and tried to terminate the malware process, auto mode blocked the cleanup command itself, letting the malicious process keep running. The account comes from a link-blog summary by Simon Willison citing Rehberger's research rather than a full primary methodology writeup, and disclosure status to Anthropic is not stated in the source.
rss · Simon Willison · Aug 27, 22:50
「Why auto mode was trusted」 Anthropic made Claude Code's auto mode the default for Pro, Max, and Team plans starting mid-August 2026, pairing it with a prompt-injection probe that screens tool outputs and default-deny rules covering data exfiltration, destructive Git operations, and sensitive data access. The change was pitched as letting the agent work autonomously for longer stretches while catching dangerous commands, effectively asking users to rely on the classifier layer rather than manual approval for every action. Enterprise customers were left to opt in separately, but Pro, Max, and Team users were switched over by default, widening the population depending on this protection.
「Who is affected」 This concerns organizations and individuals running Claude Code with auto mode enabled, which Anthropic recently made the default approval mode for the coding agent. Exposure is highest for unattended or lightly supervised agent runs that have network access and can fetch and execute external archives or packages, especially where the agent's runtime has access to home directories, SSH keys, or cloud credentials. Teams should check whether their Claude Code deployments rely on auto mode as a primary defense against prompt injection, and whether agents run with broad filesystem or credential access rather than inside a restricted sandbox.
「What reduces the risk」 No vendor fix is described in the source. The researcher's recommended compensating control, endorsed by Willison, is to run unattended coding agents inside a container, VM, or OS sandbox, restrict network egress, monitor agent activity, and avoid exposing home directories, SSH keys, or cloud credentials to the agent runtime, treating auto mode as insufficient on its own against adversarial input.
References
Tags: #prompt injection, #AI agent security, #Claude Code, #coding agents, #LLM safety