Breaking Claude Code Opus 5 Auto Mode

8.2 relevance

Breaking Claude Code Opus 5 auto mode, cutting-edge AI agent security research.

AI/ML embracethered.com

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

For engineers building agentic workflows on LLMs, this demonstrates that safety classifiers in Auto Mode are insufficient against targeted attacks, meaning any production agent must run in isolated environments with strict network and filesystem controls regardless of vendor safety claims.

Key Takeaways

Never trust Auto Mode or safety classifiers alone—always run LLM agents in sandboxed environments with explicit allow-lists for network access and filesystem writes.

Summary

A targeted attack chain achieves 60-80% success rate against Claude Code Opus 5 in Auto Mode, contradicting Anthropic's commissioned evaluation showing 0.00% prompt injection success. The attack works by nudging Claude from WebFetch to curl, redirecting it to a ZIP archive containing a malicious struct.py that shadows Python's standard library, achieving code execution when Claude imports base64. Auto Mode, which replaced human approval with a safety classifier and became default in mid-August, fails to prevent this indirect injection despite Anthropic's claims of layered defenses including model training, input probes, and an intent classifier.

Author

wunderwuzzi