Researcher Breaks Claude Code Opus 5 Auto Mode, Achieving 80% Attack Success Rate
Bedrovelsen · x · 2026-08-30
Security researcher @wunderwuzzi23 published an analysis breaking Claude Code Opus 5's Auto Mode, achieving a 60-80% attack success rate in a targeted test chain.
Context
- Anthropic introduced Auto Mode to replace human approval prompts with a safety classifier by default.
- A third-party evaluation (Trajectory Labs) previously reported a 0.00% success rate for indirect prompt injection attacks on Opus 5 in Auto Mode.
The Attack Chain
- Tool Switching: Nudge Claude to abandon the built-in WebFetch tool and use curl directly.
- Malicious Redirect: Redirect the request to a ZIP archive containing files with special encoding.
- Execution Bypass: Although Claude refuses to execute the binary and writes its own Python decoder instead, it runs that decoder inside an attacker-controlled directory, leading to code execution.
Conclusion
- Auto Mode is not a substitute for running agents in an isolated environment with monitoring.
- Despite claims that layered defenses (model training, input probes, intent classifier) reduce attack rates to near zero, targeted attack chains remain effective.
More from coding & agent
- Livestream: Exploring How Agent Loops Work in Practice — JnBrymn · 2026-09-01
- Compound Engineering 3.24.0: Speeds Up Long Autonomy and Sharpens Code Review — kieranklaassen · 2026-09-01
- How Vercel uses design systems and evals to build better agents — JohnPhamous · 2026-09-01
- Reviewing individual AI outputs doesn't scale; reviewing failure patterns does — ClickOk5811 · 2026-09-01
- Human Oversight Beats Pure Vibe Coding: Design Patterns Are Key for AI Speed — jonathan_wilke · 2026-09-01
- Using GPT 5.6 SOL as Orchestrator with 5.3 Codex as Worker — No-Hour8340 · 2026-09-01