Claude Code Opus 5's Auto Mode Falls to 80% Injection
Claude Code Opus 5, now defaulted to Auto Mode, showed an 80% prompt injection success rate in new testing, directly contradicting a third-party vendor's 0.00% claim.
Why it earned a slot
A new report shows Claude Code Opus 5 Auto Mode can be hijacked with an 80% attack success rate, despite a third-party evaluation commissioned by Anthropic reporting a 0.00% prompt injection success rate for the same model. That's a pretty stark difference, especially since Auto Mode became the default starting behavior for Claude Code sometime in mid-August. The exploit, detailed by 'Embrace The Red,' starts with a simple website summary request. It then nudges Claude into using `curl` directly, redirecting it to a ZIP archive with specially encoded files. Claude, to its credit, refuses to execute a binary, but then writes its *own* Python decoder and runs it inside the attacker-controlled directory. Here’s where it gets interesting: a malicious `struct.py` shadows Python’s standard implementation. So when Claude imports the `base64` module, it triggers the poisoned `struct.py`, leading to code execution. The plan was correct, the execution environment was not. This isn't just about a clever hack. It cuts right to the core of what we expect from "safety classifiers" and "layered defenses." Boris Cherny from Anthropic had posted that such defenses could get indirect prompt injection to "approximately zero." And Trajectory Labs, the vendor they hired, found exactly that: 0.00% success across 72 scenarios. I don't know the specifics of Trajectory Labs' testing methodology or the exact scenarios they ran. Maybe they didn't anticipate this particular attack chain, which is often the case with real-world exploits. But what I do know is that a claim of zero percent, especially in a system as complex as an LLM agent that interacts with external tools, feels inherently fragile. "Auto Mode" replacing human approval prompts with a classifier is a convenience, not a substitute for an isolated environment and rigorous monitoring. If your agent is going to execute code, it needs to be in a sandbox that you control, with explicit permissions, not just relying on a model's internal safety guardrails, no matter how many layers they claim to have. This whole situation highlights a recurring problem: vendor evaluations often look good on paper, but they don't always reflect the creative, adversarial attacks that emerge in the wild. If you're building with agents, plan for the worst-case scenario. Assume the model can be tricked, because it probably can.