Breaking Claude Code Opus 5 Auto Mode

What it is

Simon Willison's link-blog analysis of Johann Rehberger's attack against Claude Code Opus 5's Auto Mode — the safety classifier Anthropic recently made the default for its coding agent and made "bold claims" about. Rehberger reports the attack succeeds ~80% of the time.

How it works

The chain the page describes, worth stating precisely because the existing summary garbles it: Claude Code is tricked into downloading a zip and uncompressing it, then running code that does import base64. Importing base64 transitively imports struct — and a malicious struct.py extracted from the archive is picked up and executed instead of Python's stdlib module. So the payload is not a substitute for base64; it's a shadowed transitive dependency that runs during an innocuous-looking import.

The second finding is the sharper one: in some runs Claude detected the compromise and issued a command to terminate the malware process, and Auto Mode's classifier blocked the cleanup command. The classifier permitted process creation but denied its own agent's remediation — the safety mechanism became part of the failure.

flowchart TD
    A[Agent runs import base64] --> B[Transitive import of struct]
    B --> C[Local struct.py from archive executes]
    C --> D[Malware process running]
    D --> E{Claude notices compromise}
    E -->|issues kill command| F[Auto Mode BLOCKS cleanup]
    F --> D

Preconditions / Affected

Claude Code Opus 5 with Auto Mode enabled (now the default), running unattended with the ability to fetch and unpack remote archives and execute code, in an environment exposed to adversarial content.

What to do

The page's mitigation list — treat these as the operative guidance since Auto Mode is shown to be insufficient on its own:

• Run unattended coding agents in a container, VM, or OS sandbox.
• Restrict network egress.
• Monitor your agents.
• Do not expose home directories, SSH keys, or cloud credentials to the agent runtime.

Caveats

An Update (30th Aug 2026) reframes the classification: a Lobste.rs commenter (hyperpape) notes this is not classic prompt injection — no malicious instructions from a website are followed by the LLM. Willison agrees it's better called a confused environment attack: the exploit arises from the environment the agent is exposed to, not from injected text. The 80% figure is Rehberger's own claim as relayed here, not independently reproduced in the post.