Simple website summary request hijacks Claude Code Opus 5 Auto Mode with 80% attack success
Breaking Claude Code Opus 5 Auto Mode
A researcher demonstrates a prompt injection chain that achieves remote code execution on Claude Code Opus 5 in Auto Mode with up to 80% success rate. The attack tricks the model into using curl, extracting a ZIP archive, and writing its own Python decoder—which then triggers a malicious struct.py via module shadowing. This contradicts Anthropic's third-party evaluation showing 0.00% attack success. The researcher also found that Auto Mode sometimes blocks Claude's cleanup attempts, and that the attack can spawn a second Claude instance. Anthropic closed the report as 'Informative,' stating Auto Mode is not a security guarantee.
The classifier allowed the creation of the malware process, but then it blocked the command intended to stop it!
- andai
>But it runs that decoder inside the attacker-controlled directory (unzipped archive)
>There a malicious struct.py shadows Python’s standard implementation
I ran into this myself, where some file I had given a random name turned out to shadow some Python standard library module, giving me the weirdest startup crash ever.
That definitely doesn't seem to me like how that should be designed, magically silently importing everything you see and overriding basic functionality.
- colinmarc
What's interesting to me about this is that it targets Claude's specific tics. Anthropic has created model that reliably reaches for the same tools (yes, and phrases; `python -c` is a load-bearing tool for it). Everyone gets the same model, so by learning the model's behavioral patterns you can target it better.
- kstenerud
Just one of the many reasons why I run my agents sandboxed (and why I wrote agent sandboxing software).
I once caught my Claude agent complaining that it couldn't connect to https://some-weird-domain.com because the network was down (I disable network in the sandbox when it doesn't need it, and broker the API connection). I asked why it was looking there and it told me I'd asked it to.
I never found any evidence of prompt injection, but it sure as hell made me paranoid.
- rcxdude
I would not really call this a prompt injection attack, since it doesn't really hijack the agent to become malicious (something the article does discuss later on). It's more a trojan that's aimed at tricking Claude specifically.
- comboy
Interesting attack, very nicely designed. Not sure if it's much related to the auto mode itself though.
- hahn-kev
As a non Python dev this seems like very surprising behavior for a system library to be modified by just having a file with a specific name in the same folder.
- pvillano
LLMs are inherently unverifiable and untrustworthy. The training data may be incorrect, malicious, censored, or modified to serve the parent company. The model itself is a black box. Safe input is impossible: there is no way to escape natural language or separate command and data into separate streams. The output is stochastic, better on average than any algorithm could ever be, but with no guarantees on individual cases.
All of that is fine, because an LLM is a text-only interface. It cannot harm the computer because it cannot perform actions.
Why the fuck would you give it a shell?
Obviously, it's to have a product that can do anything as quickly as possible. You can make a shell-based harness in a day. Since the competition has a shell-based harness, every AI company that wants to keep up has to as well. They're stuck forever trying to plug all the holes in an attack surface as broad as written word. Solving this impossible problem requires ideas as brilliant as using a second untrustworthy LLM to validate the output of the first untrustworthy LLM that is following instructions from the internet.
- alkonaut
The problem with sandboxing is that the regular dev env (massive IDE:s, cloned megarepos, installed dependencies and so on) just won't sandbox very easily. I can't set up a "second machine" or an "isolated environment" to run claude cli in. At least not in the sense of a VM, physical hardware, container etc. Not sure what the best practices are for whitelisting tools/directories and so on, but so far the only useful mode I have found is just "allow everything and go to lunch". And it doesn't feel like I'm holding it right, but here we are.