Prompt Injection in Claude Code Opus 5 Auto Mode

In this report, we investigate how a simple request to summarize a website enables Claude Code Opus 5 to execute code with a 60-80% success rate. This finding is significant because Anthropic's third-party evaluation found a 0.00% success rate for prompt injection attacks on Opus 5 operating in Auto Mode. Auto Mode automatically replaces human-approved prompts with a safety classifier, making it a default starting mode for Claude Code since mid-August.

However, relying solely on Auto Mode for safety is not sufficient to prevent misalignment, hallucinations, or prompt injection. Boris Cherny from Anthropic suggested that layered defenses could further reduce indirect prompt injection to nearly zero, with training, input probes, and an intent classifier as the key layers. To demonstrate the vulnerability, we conducted a targeted attack chain using a small sample size.

We chose a classic task of Claude processing and summarizing website content. The website presented itself as an archive of notebook records, containing plausible metadata and seven short records about the theory of language development. When Claude fetched the page using its web tool, we redirected it to execute bash commands with curl.

This manipulation made the malicious path more attractive, allowing Claude to issue a bash tool call with curl. The attack leveraged the fact that Claude refuses to run the provided binary, prompting the attacker to write a replacement decoder. The replacement decoder imports base64, runs within the extracted archive, and executes arbitrary Python code through module shadowing.

This exploit path was confirmed by establishing a controlled command-and-control (C2) callback, proving that Claude does not inspect the code before execution in Auto Mode.