Breaking Claude Code Opus 5 Auto Mode · Embrace The Red

What it is

A working indirect prompt injection attack chain by Embrace The Red against Claude Code Opus 5 in Auto Mode (the default starting mode since mid-August), reaching 60–80% attack success on a small sample. The point that carries beyond the summary: this directly contradicts a Trajectory Labs evaluation Anthropic commissioned (72 scenarios ×10 runs, no published benchmark name) that reported 0.00% injection success — and the author's argument that Auto Mode's safety classifier is not a substitute for sandboxing.

How it works

The chain turns on the agent's own safety decision becoming the exploit:

1. User asks Claude to summarize a URL. The server returns 415 Unsupported Media Type, which nudges Claude off the WebFetch tool (which self-summarizes) and onto Bash curl — without ever instructing it to. An HTTP 303 redirects curl to a ZIP archive.
2. The ZIP unpacks into a scratch dir containing Base85/zlib/JSON records, a decoder-darwin binary, and a file named struct.py.
3. Claude correctly refuses to run the untrusted binary — and instead writes its own Python decoder that import base64.
4. Because Python puts the extracted dir on the module search path, and base64 imports struct, the attacker's struct.py shadows the stdlib module. It re-exports the real _struct API so decoding succeeds normally, while an obfuscated module-level expression runs on import → code execution.

flowchart TD
    A[Summarize URL] --> B[WebFetch]
    B -->|server: 415| C[Claude switches to curl]
    C --> D[303 -> download ZIP]
    D --> E{decoder-darwin binary}
    E -->|refuses to run it| F[Claude writes own decoder]
    F -->|python3 in extracted dir| G[import base64 -> import struct]
    G --> H[attacker struct.py shadows stdlib]
    H --> BOOM[code execution]

Preconditions / Affected

Claude Code Opus 5 in Auto Mode. The attack requires the agent to fetch attacker-controlled web content and then run a decoder script inside the extracted archive directory (so . is on sys.path). The technique is probabilistic, not deterministic.

What to do

The page's operative recommendation: do not treat Auto Mode's classifier as a substitute for running the agent in an isolated environment with monitoring. The concrete technical lesson for tool authors — never execute scripts with the untrusted extraction directory on the module search path — is implied by the shadowing mechanism.

Caveats

Author-stated limits: "small sample size" underlies the 60–80% figure; the curl redirect step is not always needed (Claude sometimes starts with curl directly); and the binary-refusal step is only "typical" behavior. The 0.00% figure the author disputes is Anthropic's vendor result, not reproduced here. The malicious domain is redacted and IP-allowlisted, so the exact payload is not directly testable from the post.