Claude Code's auto mode safety bypassed 80% of the time in proof-of-concept attack
Simon Willison
By
Originally published as “Breaking Claude Code Opus 5 Auto Mode”
Highlights
- Auto mode safety mechanism bypassed 80% of the time via zip archive exploit
- Safety classifier blocked cleanup commands after detecting compromise
- Sandboxing and network isolation are essential, not optional safeguards
- LLM safety alone insufficient for autonomous agent deployment
Prompt injection researcher Johann Rehberger has demonstrated a vulnerability in Claude Code's auto mode safety mechanism, achieving an 80% success rate in a proof-of-concept attack. The exploit works by tricking the agent into downloading and executing a zip archive containing malicious code that bypasses detection. Critically, Rehberger found cases where auto mode not only failed to prevent the attack but actively blocked Claude's own cleanup commands after detecting compromise. This reveals a fundamental tension: the safety classifier can inadvertently become part of the failure chain. The findings underscore that coding agents require additional layers of protection—sandboxing, network restrictions, credential isolation, and monitoring—rather than relying solely on LLM-based safety mechanisms. Anyone deploying autonomous coding agents in production environments should treat this as a cautionary case study in defense-in-depth.
