DEV Community

Shubham Chaudhary
Shubham Chaudhary

Posted on

Claude Code Opus 5 Auto Mode Hijacked: Anthropic's 0% Claim Broken 60-80% of the Time

#cybersecurity #ai #webdev #python

Anthropic said Claude Code Opus 5's Auto Mode had a 0% prompt injection success rate across 720 test attempts. A security researcher broke it 60-80% of the time — and the trigger was just "summarize this website."

Here's the attack chain, and it's a good lesson in why AI safety classifiers alone aren't enough:

  1. WebFetch hits an error → Claude falls back to curl (normal behavior)
  2. The request redirects to a ZIP disguised as a data archive
  3. Claude correctly refuses to run a suspicious binary inside it
  4. But writes its own Python decoder to process the data instead
  5. Runs it from the extracted folder — which contains a file named struct.py 
cd extracted-archive
python3 -c 'import base64, zlib, json; ...'
Enter fullscreen mode Exit fullscreen mode

Python resolves imports from the current working directory before the standard library. The fake struct.py silently hijacked the import, spawned a background process, and called home to a C2 server — all while the safety classifier saw nothing but a harmless decode command.

This is classic Python module shadowing (same class of bug as typosquatted PyPI packages) repurposed to weaponize an AI agent's own problem-solving behavior. The classifier judged the command in front of it, not the downstream consequences.

If you're running Claude Code, Copilot agents, Codex, or any autonomous coding assistant, the real takeaways are:

  • Sandbox agents in containers/VMs, no prod credentials
  • Restrict outbound network access to an allowlist
  • Monitor for unexpected child processes from interpreters
  • Audit archives for module name collisions before letting an agent import from them

Full attack chain breakdown + detection/prevention checklist:
https://www.xpert4cyber.com/2026/08/claude-code-opus-5-auto-mode-hijacked.html

Top comments (0)