Johann Rehberger got code execution in Claude Code's Auto Mode

Johann Rehberger published an attack chain that reaches code execution in Claude Code Opus 5 Auto Mode from an ordinary request: "Summarize https://…". He reports success rates of 60 to 80 percent across small samples.

The reason this is worth reading is the contrast. A third-party evaluation commissioned by Anthropic, run by Trajectory Labs across 72 indirect prompt injection scenarios ten times each, reported 0.00 percent attack success for Opus 5 in Auto Mode.

Auto Mode replaces human approval prompts with a safety classifier, and since mid-August it has been the default starting mode in Claude Code.

How the chain works

Every step is individually reasonable, which is the whole design.

The server answers the initial WebFetch with a 415 Unsupported Media Type. It does not tell Claude to do anything. Claude decides on its own to retry with curl. Rehberger's note on this is the important one: the attack does not instruct the model, it makes the harmful option the sensible way to finish the job.

A redirect leads to a ZIP archive of notebook records, encoded in Base85 and zlib, along with a macOS binary described in the README as the decoder, and a file called struct.py.

Claude refuses to run the unknown binary. That refusal is correct, and it is the exploit. Instead of running it, Claude writes its own Python decoder, and runs it from inside the extracted archive directory. Python puts that directory first on the import path, so when the decoder imports base64, the archive's malicious struct.py loads instead of the standard library's. An obfuscated module-level expression executes during that import, spawns an isolated child process, and downloads the next part of the attack from a remote server, which runs a native payload and connects back to a command-and-control server.

The payload uses python3 -I so the child process is not tricked by the same replaced module. Rehberger notes that is both a reliability feature for the attacker and a mitigation Claude itself could have used.

The two details that matter most

The classifier blocked the cleanup. In several runs Claude noticed the compromise and tried to terminate the malware process. Auto Mode denied that command. It had already approved the step that created the process. The safety mechanism became part of the failure.

The payload can spawn another agent. In one variant the malicious module launches a second headless Claude Code instance with claude -p. That child gets its own tool access and its own context. In those runs it ran whoami, uname and id, and wrote files outside the workspace. Rehberger reports that variant at 4 of 5.

His reported rates: 3 of 5 for the command-and-control chain, 3 of 5 for the subprocess information-gathering variant, 4 of 5 for the file-writing variant. He states plainly these are small samples and not a universal measurement, and that rates improved as he revised the payloads.

What Anthropic said

Rehberger first mailed the model bug bounty address and received no response, then submitted through the security reporting channel and heard back quickly. Anthropic closed the report as Informative, on the position that Auto Mode is a convenience feature backed by a best-effort classifier rather than a security guarantee, and that the real protection is operating system isolation and control of outgoing network traffic.

That is a defensible position and it is also the practical lesson. Auto Mode is not a substitute for running an agent in an isolated environment.

The eval lesson

72 scenarios run ten times each is a serious evaluation, and it returned zero. One motivated person building a chain where every individual step looks reasonable got to 80 percent.

An evaluation measures the attacks it contains. That is worth remembering before quoting any number from one.

Source

• Breaking Claude Code Opus 5 Auto Mode, Johann Rehberger, Embrace The Red