Auto Mode Bypassed with 80% Success Rate

Prompt injection researcher Johann Rehberger has published a significant security finding against Claude Code's auto mode — Anthropic's primary defense mechanism for protecting users of its coding agent from adversarial attacks. Anthropic recently made auto mode the default and has publicly touted its effectiveness. Rehberger's results tell a different story.

The attack works by convincing Claude Code to download and decompress a zip archive. When the agent subsequently executes code that imports Python's base64 module, it unknowingly loads a malicious struct.py file that was extracted from the archive — a classic Python module shadowing technique. Rehberger reports the attack succeeds approximately 80% of the time.

Auto Mode Blocked Its Own Cleanup

The most unsettling finding was not the initial bypass, but what happened after Claude noticed it had been compromised. In multiple test runs, the agent correctly identified the malware process and attempted to terminate it — only to have auto mode's classifier block the remediation command.

"Claude detects the compromise, but Auto Mode blocks its cleanup command. The safety mechanism itself can become part of the failure. The classifier allowed the creation of the malware process, but then it blocked the command intended to stop it."

— Johann Rehberger

This reveals a fundamental tension in classifier-based safety systems: a model trained to block "dangerous" commands may be unable to distinguish between malicious execution and legitimate remediation.

Sandboxing Remains the Only Reliable Mitigation

Simon Willison, who covered the research, agrees with Rehberger's core conclusion: behavioral classifiers alone are insufficient when agents operate in adversarial environments. The only robust mitigation is environmental isolation. Rehberger's recommended controls include:

  • Run unattended coding agents inside a container, VM, or OS-level sandbox
  • Restrict network egress from the agent runtime
  • Actively monitor agent behavior and logs
  • Never expose home directories, SSH keys, or cloud credentials to the agent runtime

Implications for Agentic AI Security

This research underscores a growing concern in the agentic AI space: as coding agents gain more autonomy and are deployed in unattended modes, the attack surface expands dramatically. Prompt injection — manipulating an agent through content it processes rather than direct user input — remains an unsolved problem at the model level. Until it is, infrastructure-level defenses like sandboxing are not optional; they are essential.