Researcher Bypasses Claude Code's Auto Mode for 80% Code-Execution Rate

A security researcher at Embrace The Red demonstrated a reliable code-execution attack against Claude Code Opus 5 running in Auto Mode, the setting that replaced manual approval prompts with an automated safety classifier and became the default in mid-August. The finding is notable because a third-party evaluation commissioned by Anthropic (run by Trajectory Labs across 72 indirect prompt-injection scenarios) reported a 0.00% attack success rate for this exact configuration. Against a purpose-built attack chain, the researcher hit success rates of 60-80% on a small sample.

The attack never issues an explicit instruction; instead it engineers the environment so the malicious path is the one Claude naturally chooses. A request to summarize a benign-looking archive site returns a 415 error, nudging Claude off the sandboxed WebFetch tool and onto curl in Bash. A redirect delivers a ZIP of encoded notebook records bundled with a macOS decoder binary and a file named struct.py. Claude correctly refuses to run the untrusted binary and instead writes its own Python decoder, then runs it from inside the extracted directory, which is the exact fatal move: Python’s base64 module imports struct, so the attacker’s shadowing struct.py loads first. Its obfuscated import-time code spawns an isolated child process that pulls down and runs a remote payload, establishing a C2 callback and popping Calculator as proof.

The core lesson is that Claude’s safety reflex, distrusting the supplied binary in favor of code it authored itself, is what carries it into the danger zone, and the classifier only ever sees the innocuous-looking decoder script while the real exploit sits several hops away. The takeaway for practitioners: Auto Mode is not a substitute for running agents in an isolated environment with active monitoring, and vendor benchmarks showing near-zero injection rates can collapse under a targeted, multi-stage chain.