Claude Code Opus 5 Auto Mode hijacked via prompt injection with up to 80% success rate
bibryam · x · 2026-09-03
Security researcher wunderwuzzi (Embrace The Red) reports that Claude Code Opus 5's Auto Mode can be hijacked via a simple website summary request, achieving code execution with a 60-80% attack success rate in small-sample testing.
Context:
- Auto Mode became the default starting mode for Claude Code in mid-August, replacing human approval prompts with a safety classifier.
- A third-party evaluation commissioned by Anthropic (Trajectory Labs, 72 indirect prompt injection scenarios, 10 runs each) showed a 0.00% attack success rate.
The attack chain:
- Nudge Claude from WebFetch into using curl directly;
- Redirect it to a ZIP archive with specially encoded files;
- Claude correctly refuses to run the bundled binary and writes its own Python decoder;
- But it runs that decoder inside the attacker-controlled directory, completing the hijack.
The author's key takeaway: Auto Mode is not a substitute for sandbox isolation and monitoring, even with layered defenses in place.
More from coding & agent
- Open models below 4-bit struggle at self-iterating 3D asset generation, HF dev finds — mervenoyann · 2026-10-21
- Developer Moves AI Agents to a Dedicated Linux Workstation Using Incus System Containers — kevinkern · 2026-10-21
- Motion Launches a General Video Agent That Edits Footage and Mimics Any Reference Style — mhdfaran · 2026-10-21
- MCP Platform NitroStack Wins Product Hunt Product of the Day, Focuses on Retention — EstablishmentFun4373 · 2026-10-21
- CodeRabbit Ships 5,000 PRs a Week With a Tiny Team, Hires by Strategy-Game Hours — omojumiller · 2026-10-21
- LukeW maps the five UI problems every AI-native company faces with agents — LukeW · 2026-10-21