Claude Code Opus 5 Auto Mode hijacked via prompt injection with up to 80% success rate
bibryam · x · 2026-09-03
Security researcher wunderwuzzi (Embrace The Red) reports that Claude Code Opus 5's Auto Mode can be hijacked via a simple website summary request, achieving code execution with a 60-80% attack success rate in small-sample testing.
Context:
- Auto Mode became the default starting mode for Claude Code in mid-August, replacing human approval prompts with a safety classifier.
- A third-party evaluation commissioned by Anthropic (Trajectory Labs, 72 indirect prompt injection scenarios, 10 runs each) showed a 0.00% attack success rate.
The attack chain:
- Nudge Claude from WebFetch into using curl directly;
- Redirect it to a ZIP archive with specially encoded files;
- Claude correctly refuses to run the bundled binary and writes its own Python decoder;
- But it runs that decoder inside the attacker-controlled directory, completing the hijack.
The author's key takeaway: Auto Mode is not a substitute for sandbox isolation and monitoring, even with layered defenses in place.
More from coding & agent
- Fable 5.1 burns 102K reasoning tokens and hits the 128K output ceiling mid-code — rohanpaul_ai · 2026-09-03
- Browser agent failure mode: the page said no, but the agent thought it succeeded — ahstanin · 2026-09-03
- Web Draw drives a real browser with text-only models, ~750 tokens per Amazon page — ahstanin · 2026-09-03
- Claude Code v2.1.259 ships managed MCP servers, unattended permission mode and sandbox fixes — ashwin-ant · 2026-09-03
- Meta's Muse Spark 1.3 lands on OpenRouter with 1M context for agentic workflows — armand_ruiz · 2026-09-03
- Rival AI agents: cross-vendor model review catches what self-review misses — rseroter · 2026-09-03