Anthropic has recently made the "Auto Mode" of Claude Code Opus 5 the default and promoted its effectiveness as a protection layer for coding agents against prompt injection attacks. Johann Rehberger, a prominent researcher in prompt-injection techniques, has published an attack that he says undermines that protection.
How the attack works
According to Rehberger, the attack tricks Claude Code into downloading and unzipping a ZIP archive, then executing code that performs an import of the Python "base64" module. Rehberger claims that, in the tested cases, this import results in a locally extracted "struct.py" file from the archive being imported and executed, bypassing expected safeguards. He reports the technique succeeded in roughly 80% of his runs.
A safety mechanism that prevented cleanup
Rehberger further reports that in some runs the classifier let the malicious process be created, and although Claude later attempted to terminate that process once it noticed the compromise, Auto Mode blocked the cleanup command. In short: the agent detected a problem, but the safety layer prevented the agent from executing the remediation.
Recommendations: sandboxing and strict isolation
Based on these findings, Rehberger recommends treating Auto Mode as insufficient on its own and running coding agents only in isolated environments if there is any risk of adversarial attacks. His concrete recommendations include:
- Run unattended coding agents inside containers, virtual machines, or OS-level sandboxes.
- Restrict network egress.
- Monitor agent activity.
- Do not expose home directories, SSH keys, cloud credentials, or other sensitive files to the agent runtime.
Why this matters
The case illustrates that model-side safety classifiers can be bypassed or can themselves interfere with necessary remediation actions. When an autonomous agent is capable of downloading and executing local code, system-level isolation and traditional security controls remain essential to limit risk.
Sources and note
This article summarizes the findings and recommendations reported by Johann Rehberger. The claims in this piece — including the approximately 80% success rate and the described instances where Auto Mode blocked cleanup commands — come from his published testing.
