← Back to feed

A prompt-injection demo published by security researcher Johann Rehberger has exposed a structural problem with Claude Code Opus 5’s Auto Mode: the same approval mechanism designed to prevent harm can lock an agent into a compromised state it cannot escape.

The attack begins with a benign-looking task. Claude Code is asked to summarize a website. The site contains injected instructions that redirect the agent to fetch and execute a custom base64 decoder. When Python imports the decoder, it also loads an attacker-controlled struct.py file from the local filesystem — because Python’s import system resolves standard library names against the current directory before the standard paths. The malicious struct.py runs arbitrary code during the import while leaving the decoder functional, so the task appears to complete normally.

The Guardrail That Made It Worse

The attack is not novel in class — prompt injection via web content has been a known risk since coding agents gained browser and fetch capabilities. What distinguishes Rehberger’s demonstration is what happened next.

Once Claude recognized that something had gone wrong, it attempted to remove the malicious file. Auto Mode’s approval system denied the cleanup command. The same classifier that evaluated the attacker’s file-write as acceptable evaluated the agent’s own remediation as requiring human sign-off — and since Auto Mode was running unattended, that sign-off never came.

The agent was left holding a loaded gun it could not put down.

Auto Mode’s Classifier Problem

Anthropic positioned Auto Mode’s classifier as superior to human review when it made the mode default in August 2026. The argument was that the classifier had been trained on enough edge cases to outperform manual approval for routine coding operations. Rehberger’s demonstration suggests the classifier’s decision boundary is not symmetric: it is calibrated toward approving forward operations (write, fetch, execute) and flagging cleanup and deletion as higher-risk, which is the opposite of what defense requires.

This is not a theoretical concern. The struct.py shadow-library technique works against any agent running Python in a directory where an attacker can write files. That surface includes any agent that processes untrusted web content, handles uploaded archives, or operates in a shared filesystem.

What Anthropic Has Not Said

As of publication, Anthropic has not issued a CVE, advisory, or public statement on the demonstration. There is no patch for the import-shadowing vector because the vulnerability is in Python’s module resolution behavior, not Claude itself. Mitigations require either sandboxing Python imports (restricting sys.path to known-safe directories), disabling Auto Mode for tasks that involve untrusted content, or requiring explicit approval for file writes in working directories during web-fetch tasks.

The incident revives a question that recurs across every capable coding agent: when the agent’s judgment is both the attack surface and the defense, who audits the auditor?