Researcher demonstrates prompt injection bypass in Claude Code Opus 5 Auto Mode

Johann Rehberger, a leading prompt injection researcher, identified and demonstrated an attack against Anthropic’s Claude Code Opus 5 Auto Mode that bypasses its defenses in 80% of attempts. The attack works by tricking the coding agent into downloading and uncompressing a zip archive, then executing code that imports the base64 module. Crucially, the archive contains a local struct.py file that is executed during the import, enabling a compromise of the agent’s runtime environment.

In several observed runs, the agent detected the compromise and attempted to terminate the malicious process. However, Auto Mode blocked these cleanup commands, preventing the agent from stopping the harmful execution. This demonstrates a failure mode where the safety mechanism itself becomes part of the attack chain: the classifier allowed the creation of the malware process, but then blocked the command intended to stop it.

The findings suggest that relying solely on Auto Mode for protection against prompt injection in autonomous coding agents is insufficient. Rehberger recommends running unattended coding agents in isolated environments such as containers, VMs, or OS sandboxes, restricting network egress, monitoring agent activity, and avoiding exposure of sensitive directories or credentials to the agent runtime.