Claude Code's Auto Mode just got broken, four days after Anthropic said prompt injection was basically solved
Security researcher wunderwuzzi (Embrace The Red) built a working indirect prompt injection chain against Claude Code Opus 5's Auto Mode, achieving 60-80% code execution success in testing, days after Anthropic's Boris Cherny said outside evaluation showed 0.00% attack success. Anthropic's own response to the disclosure is the most useful part: Auto Mode's classifier was never meant to be a security boundary in the first place.
The claim that got tested
In a recent talk, Boris Cherny, one of Claude Code's builders, said prompt injection was effectively a solved problem for the tool: "we just cannot demonstrate prompt injection anymore." He pointed to a chart showing 0.00% attack success for Opus 5 in Auto Mode, based on an outside evaluator (per the post, Trajectory Labs) running 72 indirect prompt injection scenarios, ten times each.
That's a real benchmark result. It's also, by construction, a benchmark of known scenarios. wunderwuzzi's post, published August 26, is what happens when someone builds a chain the benchmark wasn't testing for.
The attack chain
Worth reading in full on the original post, but the shape of it:
- A server returns an HTTP 415 error to Claude's WebFetch request. Claude, reasonably, falls back to curl.
- Curl pulls down a ZIP archive containing what looks like ordinary notebook records, plus a malicious payload.
- The archive includes a binary decoder. Claude correctly refuses to execute an unknown binary. Good instinct.
- Instead, Claude writes its own Python decoder to handle the archive, and runs it from inside the extracted directory.
- That directory contains a malicious
struct.py, shadowing Python's standard library module of the same name. - When Claude's own decoder imports
base64, which transitively importsstruct, it silently imports the attacker's version instead of the real one. - The shadowed module downloads and executes a remote payload, opening a C2 callback (the demo uses the Sliver framework).
- The malicious process detaches and persists past the end of the Claude conversation.
None of these individual steps is a refused instruction or an obvious jailbreak. Each one is something a reasonable coding agent would plausibly do. The danger was in the sequence, not any single link in it.
Across his test variants (a remote C2 chain, a subprocess-spawning-subprocess variant, and a file-writing variant), success rates ran 60%, 60%, and 80%.
What Anthropic actually said back
This is the part worth quoting in full, because it's a more honest answer than most vendors give. Anthropic triaged the report as "Informative" and responded:
"Auto Mode is a convenience feature backed by a best-effort classifier, not a security guarantee. Determined prompt injection chains that combine benign-looking steps are not what the classifier is intended to stop. The real boundary is OS isolation and network egress control."
Read that twice. It's not a denial that the exploit works. It's a statement that the exploit was never inside the scope of what Auto Mode's classifier was built to catch. That is a correct thing to say about a best-effort classifier. It's also, per wunderwuzzi's post, a fairly different message than "we just cannot demonstrate prompt injection anymore."
The actual takeaway
A fixed benchmark, even a well-built one, measures behavior against known scenarios tested a known number of times. It cannot measure behavior against a scenario nobody wrote yet. That's not a criticism specific to Claude Code. It's true of every classifier-based guardrail on every agentic coding tool right now.
If your organization is treating an agent's "auto approve" or "auto mode" behavior as evidence that a workflow is safe to run unattended, this research is a direct counterexample, sourced from the vendor's own disclosure response. The fix Anthropic names in its own reply, OS isolation and network egress control, is infrastructure, not a benchmark score. Worth checking whether you actually have it in place before you trust the green light.
Test your own agents against chains like this, not just known scenarios:
pip install humanbound
Top comments (0)