Kiran 
Security researcher Johann Rehberger, known as “wunderwuzzi” at Embrace The Red, has published a working exploit chain that hijacks Claude Code Opus 5’s Auto Mode using nothing more than a website summarization request.
His attack achieved a 60-80% success rate on remote code execution, a striking contrast to the 0.00% prompt-injection success rate Anthropic touted just weeks earlier.
Auto Mode became the default setting for Claude Code Pro, Max, and Team users starting August 14, 2026, replacing manual approval prompts with an AI safety classifier that screens tool calls in real time.
Claude Opus 5 Auto Mode Exploited
Anthropic backed the rollout with data claiming the classifier blocks 89% of dangerous commands, compared to just 13.6% that human reviewers catch.
Anthropic Claude Code lead Boris Cherny went further on X, stating the company had “largely solved” prompt injection in practice and citing a third-party evaluation from vendor Trajectory Labs showing zero successful attacks across 720 attempts spanning 72 held-out scenarios against Claude Fable 5, Opus 5, and Sonnet 5.
Rehberger’s demonstration started with an innocuous prompt to summarize a webpage. When Claude’s WebFetch tool hit a 415 error, the model independently switched to curl, a redirect it wasn’t told to take but chose on its own. That led to a ZIP archive containing encoded “notebook records” and a suspicious macOS binary decoder.
Claude correctly refused to execute the unknown binary, but then wrote its own Python decoder to process the files instead. That decoder ran inside the extracted archive directory, where a malicious struct.py file shadowed Python’s standard library module.
Importing base64 triggered the poisoned struct.py, which launched a hidden Python process that downloaded and executed a remote payload, opening Calculator and establishing a command-and-control callback.
In multiple runs, Rehberger observed something worse: after Claude detected the compromise and tried to kill the malicious process, Auto Mode’s classifier blocked the cleanup command itself, allowing malware that had already been approved to keep running.
“What makes this exploit chain unsettling isn’t that a classifier missed one attack pattern it’s that the safety layer actively obstructed the model’s own attempt to self-correct. A security control that permits harm but blocks remediation isn’t a partial failure; it’s an inverted one.”
Rehberger reported the flaw through Anthropic’s bug bounty channel and again through its security reporting process. Anthropic closed the report as “Informative,” stating the behavior is “working as designed” since Auto Mode is a best-effort convenience classifier, not a security boundary, and that determined multi-step chains fall outside its intended scope.
That explanation is reasonable on its own, but it directly contradicts the “largely solved” framing Anthropic used to promote the feature just weeks prior.
The core lesson isn’t that Claude’s classifier is broken; it’s that a 0.00% score on a fixed 72-scenario benchmark says nothing about novel, creatively chained attacks.
Rehberger’s guidance remains the industry standard: run unattended coding agents in containers or VMs, restrict network egress, withhold credentials and SSH keys from agent runtimes, and never treat an Auto Mode approval as proof that generated code is safe.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
