Breaking Claude Code Opus 5 Auto Mode
A security researcher demonstrates that Claude Code's 'Auto Mode' is vulnerable to indirect prompt injection attacks, achieving high success rates in hijacking the agent. This finding challenges recent third-party safety evaluations that claimed zero attack success for the model.
Why it matters
It highlights the risks of relying on automated AI agents for sensitive tasks and suggests that current safety classifiers may be insufficient against sophisticated prompt injection.
In this post, we explore how a simple website summary request hijacks Claude Code Opus 5 in Auto Mode and achieves code execution with 60-80% attack success rate using a small sample size.
This is interesting because a third-party evaluation commissioned by Anthropic showed a 0.00% prompt injection attack success rate for Opus 5 in Auto Mode.
Auto Mode replaces human approval prompts with a safety classifier. Since mid-August it is the default starting mode for Claude Code.
To make my key point right away: If you care about what's happening and are worried about misalignment, hallucinations and prompt injection, then Auto Mode IS NOT a substitute for running your agent in an isolated environment and monitoring what it is up to .
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in