Claude Code Opus 5 Auto Mode hijacked via prompt injection with up to 80% success rate
bibryam · x · 2026-09-03
Security researcher wunderwuzzi (Embrace The Red) reports that Claude Code Opus 5's Auto Mode can be hijacked via a simple website summary request, achieving code execution with a 60-80% attack success rate in small-sample testing.
Context:
- Auto Mode became the default starting mode for Claude Code in mid-August, replacing human approval prompts with a safety classifier.
- A third-party evaluation commissioned by Anthropic (Trajectory Labs, 72 indirect prompt injection scenarios, 10 runs each) showed a 0.00% attack success rate.
The attack chain:
- Nudge Claude from WebFetch into using curl directly;
- Redirect it to a ZIP archive with specially encoded files;
- Claude correctly refuses to run the bundled binary and writes its own Python decoder;
- But it runs that decoder inside the attacker-controlled directory, completing the hijack.
The author's key takeaway: Auto Mode is not a substitute for sandbox isolation and monitoring, even with layered defenses in place.
More from coding & agent
- Nous Research's Hermes now launches Cua Spaces for computer-use agents — alexcovo_eth · 2026-10-21
- Burkov: AI coding agents that report 'done' may have only finished 80% of the job — burkov · 2026-10-21
- Headlong from Laude's Slingshots batch is a microharness for persistent agents — lateinteraction · 2026-10-21
- Laude Institute's Slingshots Four ships 14 open-source projects on agent harnesses and open models — lateinteraction · 2026-10-21
- Skills vs MCP vs RAG vs Memory: the four knowledge layers production agents need — MaryamMiradi · 2026-10-21
- When customer service bans AI agents, one goes incognito to fight Xfinity — MoonL88537 · 2026-10-21