Does Anthropic treat this as a security vulnerability?

Anthropic rated Rehberger's report Informative rather than a vulnerability. Its position is that auto mode is a convenience classifier, not a security guarantee, and that stopping a determined chain built out of individually benign steps is outside what a classifier can do. Anthropic points to OS-level isolation and network controls as the real security boundary for Claude Code.

How often did the attack actually succeed?

Rehberger reports three variants of the Claude Code auto mode chain. The full command-and-control version with a native payload worked in 3 of 5 runs, spawning subprocesses for reconnaissance worked in 3 of 5, and the subprocess variant that also wrote external files worked in 4 of 5. That puts the observed range at roughly 60 to 80 percent.

Why does this not contradict the 0% attack success number Anthropic cites?

A third-party evaluation of Claude Code auto mode ran 72 fixed prompt injection scenarios and recorded no successes. Rehberger's chain is a new one that was not in that set, so both numbers can be true at once. His argument is that quoting the headline figure without that caveat leaves users believing auto mode covers attacks it was never tested against.

How do I protect a coding agent against this kind of chain?

Rehberger's guidance is to stop relying on the agent's own approval step. Run Claude Code inside a container or VM, restrict its outbound network access, keep sensitive credentials out of the runtime it can reach, and log what it does. Treat an auto mode approval as a convenience, never as evidence that the code about to run is safe.

Embrace The Red · 2026-08-26 · major

Claude Code auto mode broken — a prompt injection chain that runs real code

Johann Rehberger published a prompt injection chain that gets code execution past Claude Code Opus 5 auto mode in 3 to 4 of every 5 tries. In some runs the safety classifier then blocked Claude's own cleanup command.

Diagram of the prompt injection chain that reaches code execution past Claude Code auto mode — Embrace The Red

A six-step chain gets remote code execution past Claude Code's default safety classifier, and the classifier then blocks the cleanup.

Quick facts

Researcher	Johann Rehberger
Target	Claude Code Opus 5, auto mode
Best result	4 of 5 runs (80%)
Entry point	Web content fetched with curl
Anthropic's rating	Informative, not a security boundary
Advice	Sandbox the agent; cut its network and keys

What is it?

Auto mode is the permission setting Claude Code turns on by default, and Johann Rehberger has now shown it can be walked past. His write-up documents a working chain that ends with malware running on the developer's machine and calling out to a command-and-control server. Anthropic reviewed the report and rated it Informative, saying auto mode is a convenience classifier rather than a security boundary.

How does it work?

The chain never asks Claude Code to run anything obviously bad. A server answers with HTTP 415 so the agent switches from WebFetch to curl, which pulls down a ZIP. Claude refuses the binary inside it but writes its own Python decoder instead, and that decoder imports a module the archive has already shadowed with a malicious struct.py. The obfuscated payload sits several hops away from the code the classifier can see, so it is approved.

Why does it matter?

Most teams read auto mode as a safety net and let coding agents run unattended on real machines with real credentials. Rehberger's measured rates — 3 of 5 runs for the command-and-control chain, 4 of 5 when Claude spawns subprocesses that write files — show the net has holes. The sharper detail is the failure mode: the classifier approved the decoder, then blocked the command Claude tried to run to kill the process it had started.

Who is it for?

developers running coding agents unattended

Frequently asked questions

Does Anthropic treat this as a security vulnerability?: Anthropic rated Rehberger's report Informative rather than a vulnerability. Its position is that auto mode is a convenience classifier, not a security guarantee, and that stopping a determined chain built out of individually benign steps is outside what a classifier can do. Anthropic points to OS-level isolation and network controls as the real security boundary for Claude Code.
How often did the attack actually succeed?: Rehberger reports three variants of the Claude Code auto mode chain. The full command-and-control version with a native payload worked in 3 of 5 runs, spawning subprocesses for reconnaissance worked in 3 of 5, and the subprocess variant that also wrote external files worked in 4 of 5. That puts the observed range at roughly 60 to 80 percent.
Why does this not contradict the 0% attack success number Anthropic cites?: A third-party evaluation of Claude Code auto mode ran 72 fixed prompt injection scenarios and recorded no successes. Rehberger's chain is a new one that was not in that set, so both numbers can be true at once. His argument is that quoting the headline figure without that caveat leaves users believing auto mode covers attacks it was never tested against.
How do I protect a coding agent against this kind of chain?: Rehberger's guidance is to stop relying on the agent's own approval step. Run Claude Code inside a container or VM, restrict its outbound network access, keep sensitive credentials out of the runtime it can reach, and log what it does. Treat an auto mode approval as a convenience, never as evidence that the code about to run is safe.