Security researcher Johann Rehberger has demonstrated a high-success-rate prompt injection attack against Claude Code's auto mode, Anthropic's flagship safety mechanism for its coding agent. The attack tricks the agent into downloading and decompressing a zip archive, then executing malicious code through a Python module shadowing technique — importing `base64` inadvertently runs a local `struct.py` file extracted from the archive. Rehberger reports the attack succeeds roughly 80% of the time.

Perhaps more alarming than the bypass itself is auto mode's behavior during remediation. In several test runs, Claude detected it had been compromised and attempted to terminate the malicious process — but auto mode's own classifier blocked the cleanup command, effectively trapping the agent in a compromised state. The safety mechanism, rather than helping, became part of the failure chain.

The findings cast doubt on Anthropic's bold claims about auto mode's effectiveness, which the company recently made the default for Claude Code users. Researchers and commentators are urging that unattended coding agents should never be considered safe without proper sandboxing, network egress restrictions, and isolation from sensitive credentials.