Security researcher Johann Rehberger says he found a way to bypass Auto Mode, the defense Anthropic added to Claude Code against prompt injection attacks, according to his post on Embrace The Red.
The attack starts with what looks like an ordinary request to summarize a webpage. That page leads Claude to download a zip archive containing a disguised file named struct.py. Claude refuses to run a binary decoder included in the archive and writes its own Python decoder instead, but that decoder's import of the base64 library causes Python to load the attacker's struct.py file from the extracted folder instead of the real one, Rehberger wrote. The poisoned file then runs code that downloads and executes a remote payload.
Rehberger reported 60% to 80% success rates across three variants of the attack, each tested five times. Anthropic had commissioned a third-party evaluation that found a 0% attack success rate for Auto Mode across 72 indirect prompt injection scenarios, Rehberger wrote, but his attack chain fell outside that fixed test set. "Auto Mode only sees Claude's short Python catalog decoder," Rehberger wrote. "The actual exploit was several hops away."
Simon Willison, who writes frequently about AI coding tools, called the finding a reminder that Auto Mode narrows the odds of a successful attack but does not close them, according to his post summarizing the research.
Rehberger's advice for anyone running Claude Code or similar coding agents unattended: use a sandboxed container or virtual machine with restricted network access, monitor what the agent does, and don't treat a vendor's safety layer as a substitute for isolation.