Research
Prompt Injection Experiments with Opus-5 in Claude Code - Auto-Mode Edition
Publication date not yet evaluated · Added itmeetsot.eu
Page published
Coverage timeline
Single-source research — one report is available.
Why it matters
Claude Code's auto-mode safety classifier can be bypassed via indirect prompt injection because it only sees tool-call queries and not injected payloads, meaning defenders cannot rely on it to stop agent-driven remote code execution.
An experiment tested indirect prompt injection against Opus-5 in Claude Code's new auto-mode, where a Sonnet-5 safety classifier is meant to block unsafe tool calls. Using a steganographic payload hidden in a README.jpg image, the agent was induced to download and execute untrusted remote code starting from a simple /init command; in 6 of 10 trials the agent ran the untrusted code and the classifier allowed it.