Seismic Impact (30%)
8.0/10
How newsworthy is this in AI?
Ecosystem Relevance (70%)
9.0/10
How useful for your apps?
Breaking Claude Code Opus 5 Auto Mode
Johann Rehberger is one of the most credible prompt injection researchers active today. He found an attack against auto mode which he claims works 80% of the time, by tricking Claude Code into downloading and uncompressing a zip archive, then executing code that imports base64 without noticing that this will import and execute a local struct.py file extracted from the archive.
In a few cases auto mode directly prevented the agent from preventing harmful code from continuing to execute!
In a few runs Claude tried to terminate the malware process once it noticed the compromise, but Auto Mode denied the cleanup command.
Claude detects the compromise, but Auto Mode blocks its cleanup command
The safety mechanism itself can become part of the failure. The classifier allowed the creation of the malware process, but then it blocked the command intended to stop it!
I agree with Johann's conclusion here: the only safe way to run agents if there's any risk of attracting the attention of an adversarial attack is with a sandbox:
- Run unattended coding agents in a container, VM or OS sandbox.
- Restrict network egress.
- Monitor your agents.
- Do not expose home directories, SSH keys, cloud credentials,… to the agent runtime. [...]
Tags: sandboxing, security, ai, prompt-injection, generative-ai, llms, anthropic, claude, johann-rehberger, claude-code
This is directly relevant to Zac's orchestrator architecture, which runs Claude-powered agents with tool use across 20+ Rails apps — exactly the attack surface described. The sandboxing recommendations (containers, restricted network egress, no exposed SSH keys/cloud credentials) should be audited against how the orchestrator spawns agents like rails-expert and investigator. The finding that auto mode *blocked cleanup* of malware it detected is a critical design consideration: the orchestrator should implement independent monitoring (app_monitor) rather than relying solely on Claude's self-governance to catch and remediate agent compromise.