Researcher Breaks Claude Code Opus 5 Auto Mode, Achieving 80% Attack Success Rate
Bedrovelsen · x · 2026-08-30
Security researcher @wunderwuzzi23 published an analysis breaking Claude Code Opus 5's Auto Mode, achieving a 60-80% attack success rate in a targeted test chain.
Context
- Anthropic introduced Auto Mode to replace human approval prompts with a safety classifier by default.
- A third-party evaluation (Trajectory Labs) previously reported a 0.00% success rate for indirect prompt injection attacks on Opus 5 in Auto Mode.
The Attack Chain
- Tool Switching: Nudge Claude to abandon the built-in WebFetch tool and use curl directly.
- Malicious Redirect: Redirect the request to a ZIP archive containing files with special encoding.
- Execution Bypass: Although Claude refuses to execute the binary and writes its own Python decoder instead, it runs that decoder inside an attacker-controlled directory, leading to code execution.
Conclusion
- Auto Mode is not a substitute for running agents in an isolated environment with monitoring.
- Despite claims that layered defenses (model training, input probes, intent classifier) reduce attack rates to near zero, targeted attack chains remain effective.
More from coding & agent
- Agent named 'Ilya' reportedly scores 1.1pt higher on benchmarks — daniel_mac8 · 2026-10-16
- Gemini CLI fix: substring matching inlined unrequested binary files into model context — priyanshu1976 · 2026-10-16
- Building AI agents on real healthcare claims data: the domain work that makes them work — alex_verem · 2026-10-16
- OpenAI stealth-testing mysterious internal model 'Aeon' in Codex desktop app and Dots — cedric_chee · 2026-10-16
- Vibe-coded iPhone Duo sniping bot built with Codex in 17 minutes, 41 tests passing — xiaohu · 2026-10-16
- Long-term multiplayer agent memory tool tops BEAM memory benchmark — CurieuxExplorer · 2026-10-16