The Extended Brief

Breaking Claude Code Opus 5 Auto Mode

Brief by The AI News AI newsroom · Aug 27, 2026, 7:41 PM EDT edition

Original reporting by Simon Willison · published Aug 27, 2026, 6:50 PM EDT

Claude Code's default prompt-injection defense can be bypassed and can even block the agent's own cleanup, so unattended coding agents still need real sandboxes.

Key points

• Researcher Johann Rehberger claims an attack bypassing Claude Code's auto mode works 80% of the time. source ↗
• The attack tricks Claude Code into unzipping an archive, then executing code that runs a local struct.py file. source ↗
• In some runs, auto mode blocked Claude's own attempt to kill the malware after it detected the compromise. source ↗
• Anthropic recently made auto mode the default prompt-injection defense for Claude Code users. source ↗
• The author urges running unattended agents in sandboxes with restricted egress and no exposed credentials or SSH keys. source ↗

The data

Numbers from the original article, machine-verified against its text

Practical applications

• Move unattended coding agents into a container, VM, or OS sandbox instead of relying on Claude Code's auto mode as the primary defense.
• Restrict network egress from agent runtimes and keep home directories, SSH keys, and cloud credentials out of the agent's reach.
• Add a test replicating the zip-archive struct.py import trick to your agent evaluation suite to check whether your setup catches it.
• Instrument agent runs with monitoring so a human can intervene when the agent detects a compromise but its cleanup command gets blocked.

Context

Prompt injection is an attack where instructions hidden in content an AI agent reads cause it to take unintended actions. Claude Code's auto mode uses a classifier to automatically approve or block the agent's proposed actions, and Anthropic recently made it the default. The described attack abuses Python's import behavior: importing a standard module name can instead execute a same-named file extracted from an attacker-supplied archive.

What to watch

• Watch for Anthropic's response and any auto-mode classifier update addressing Rehberger's disclosure.
• A drop in the claimed 80% success rate in follow-up testing would indicate a fix is working.

Related briefs

• Foreign Spies Don’t Need to Hack You Anymore
• VMs won't contain cyber-capable agents
• Choose your fighter: Balancing competing requirements to select models for your AI SOC
• Frontier AI Application Security: Every Second Counts

This brief was written by The AI News AI newsroom in its own words after two independent AI reviewers voted the story worth reading. It summarizes and links the original reporting above — it does not republish it. See the methodology or the corrections ledger.