An investigation into Claude Code Opus 5’s Auto Mode has highlighted a significant security flaw that allows malicious code execution via prompt injection. The vulnerability, demonstrated through a controlled experiment, showed success rates ranging from 60% to 80%.
New Research Challenges Previous Security Claims
The study conducted by Embrace The Red casts doubt on Anthropic’s past assertions of a 0.00% success rate in prompt-injection scenarios for Opus 5 Auto Mode. This revelation suggests that sophisticated, multi-stage attacks can bypass existing security mechanisms.
Claude Code’s Auto Mode aims to enhance user experience by reducing approval prompts through a safety classifier. Despite these intentions, the system is not a replacement for traditional security measures like sandboxes or operating-system controls.
Technical Breakdown of the Attack
The attack initiated with a seemingly benign task: summarizing a website. However, the targeted website, appearing as a legitimate notebook archive, manipulated Claude’s web-fetching tool to encounter an HTTP 415 error. This led Claude to attempt a direct retrieval using a shell command.
The server redirected this request to a ZIP file containing encoded data and a malicious Python script named struct.py. While Claude refrained from executing the native decoder binary, it crafted its own Python decoder, which inadvertently executed the malicious struct.py, embedded within the ZIP directory.
Implications and Security Recommendations
The tests showed that the malicious module could launch additional processes, download further payloads, and create command-and-control callbacks. A variant even operated another Claude instance in headless mode, performing unauthorized actions.
Embrace The Red emphasizes the need for organizations to treat Auto Mode as a potential security risk. They recommend deploying autonomous coding agents in isolated environments like containers or virtual machines, restricting network access, monitoring processes, and blocking untrusted code execution.
While Auto Mode helps reduce user fatigue by minimizing approval requests, the handling of untrusted sites and data sources necessitates robust sandboxing and vigilant monitoring to prevent exploitation.
Stay ahead of security threats by integrating threat intelligence into your SOC operations and enhance your first-line defense.
