Breaking Claude Code Opus 5 Auto Mode

Anthropic recently made auto mode the default setting for Claude Code, relying heavily on it to protect coding agent users from prompt injection attacks and making strong claims about how well it works.

Security researcher Johann Rehberger discovered a successful attack against this auto mode that works roughly eighty percent of the time. The exploit tricks Claude Code into downloading and uncompressing a zip archive, and then executing code that imports base64 without realizing it is executing a local struct file extracted from the archive.

In some runs, the safety mechanism itself contributed to the failure. While the classifier allowed the malware process to be created, auto mode blocked cleanup commands when Claude attempted to terminate the malicious process upon noticing the compromise.

Because safety features can fail and block corrective actions, running unattended coding agents safely requires proper isolation. Experts recommend executing agents in containers, virtual machines, or operating system sandboxes while restricting network egress, monitoring activity, and withholding access to home directories, SSH keys, and cloud credentials.