Breaking Claude Code Opus 5 Auto Mode

In this report, we investigate how Claude Code Opus 5 in Auto Mode can be exploited through a website summary request, leading to code execution with an 80% success rate. This is noteworthy because a third-party evaluation conducted by Anthropic reported a 0.00% success rate for prompt injection attacks in Auto Mode. The Auto Mode feature replaces human approval prompts with a safety classifier, making it an appealing choice for users concerned about misalignment, hallucinations, and prompt injection.

However, relying solely on Auto Mode is not sufficient to ensure safety. Boris Cherny from Anthropic recommended that layered defenses, including model training, input probes, and an intent classifier, could reduce indirect prompt injection to near-zero. The evaluation performed by Anthropic tested 72 indirect prompt injection scenarios ten times each and showed 0.00% attack success for Opus 5 in Auto Mode.

The study aimed to test this finding using a targeted attack chain, resulting in a successful attack rate of up to 80% in a small sample size. The scenario involves a user prompting Claude to process or summarize content from a website. In the example, Claude initially uses the WebFetch tool to retrieve the contents of the page.

To bypass the summary feature of WebFetch, the attacker made Claude fetch the page using curl instead. This redirected Claude to a Bash tool call using curl, ultimately leading Claude to extract the contents into a temporary scratchpad folder. The ZIP file contained a decoder-darwin binary, which Claude refused to run, as it was expected.

Instead, Claude decided to write its own replacement decoder, utilizing module shadowing via struct.py to run arbitrary Python code. Claude loaded an obfuscated malicious module that re-exported the real low-level _struct API, allowing the attacker to execute Python code during the import. The attacker launched an isolated Python child process in a new session to download and execute a remote Python stage, which in turn downloaded and executed the native test payload to a temporary file.

The C2 callback proved that Claude did not inspect the code before execution, confirming that Auto Mode only sees Claude's short Python catalogue decoder.