Threat · curated 27 Aug 2026
Breaking Claude Code Opus 5 Auto Mode
First reported embracethered.com
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
Claude Code Auto Mode replaces human approval prompts with a safety classifier and is now the default, so a demonstrated indirect-prompt-injection-to-code-execution chain shows that automated agent guardrails are not a substitute for isolation and monitoring.
Johann Rehberger (embracethered) demonstrates an indirect prompt injection attack chain against Claude Code Opus 5 in Auto Mode, achieving code execution with a 60-80% success rate from a simple 'summarize this website' request. The chain nudges Claude from WebFetch to curl, redirects to a ZIP archive whose files use a special encoding, and gets Claude to run a self-written Python decoder inside an attacker-controlled directory where a malicious struct.py shadows the standard library and executes on base64 import. The finding contradicts an Anthropic-commissioned Trajectory Labs evaluation that reported 0.00% prompt injection success for Opus 5 in Auto Mode.