Security researcher wunderwuzzi, writing on the Embrace The Red blog, published a working attack chain against Claude Code Opus 5 running in Auto Mode, Anthropic's default permission mode since mid-August 2026 that replaces manual command approval with a safety classifier. Small-sample tests produced code-execution success rates between 60% and 80%, contradicting a third-party evaluation Anthropic commissioned from vendor Trajectory Labs, which reported a 0.00% prompt-injection success rate across 72 test scenarios run ten times each.

The attack starts with an ordinary request to summarize a website. When Claude's WebFetch tool receives an HTTP 415 error, it switches to curl on its own and downloads a ZIP archive. The archive contains a decoy macOS binary called decoder-darwin plus a file named struct.py. Claude refuses to execute the unknown binary and instead writes its own Python decoder, but runs that decoder from inside the extracted archive folder. When the script imports Python's base64 module, Python's module search path picks up the attacker's struct.py instead of the standard library version, a technique known as module shadowing. The poisoned module executes obfuscated code that spawns an isolated Python child process, which downloads and runs a remote payload that opens Calculator and connects to a command-and-control server set up for the test.

In a second variant, the poisoned module launches a headless Claude Code instance via the claude -p command instead of a Python subprocess. That nested agent ran reconnaissance commands including whoami, uname and id, opened Calculator, and wrote files outside the working directory. Measured success rates across small samples were 60% for the Python C2 chain, 60% for the claude -p reconnaissance variant, and 80% for the claude -p variant with file writes. In several runs, Claude detected the compromise afterward and tried to kill the malicious process, but Auto Mode's classifier blocked the cleanup command itself.

The researcher reported the issue first to modelbugbounty@anthropic.com without receiving a reply, then filed it through Anthropic's standard security channel. Anthropic closed the report as "Informative," stating Auto Mode works as designed: it is a best-effort convenience classifier, not a security boundary, and defenders should rely on OS-level sandboxing and network egress controls instead. The researcher contrasts this with public comments from Claude Code team member Boris Cherny, who said layered defenses, model training, input probes and an intent classifier, reduce indirect prompt injection to approximately zero and that the team can no longer demonstrate prompt injection in practice.

The post recommends running unattended coding agents inside containers, virtual machines or OS-level sandboxes, restricting network egress, monitoring agent activity, and keeping credentials, SSH keys and home directories away from agent access, since Auto Mode approval alone is not proof that a command is safe.