---
title: "Breaking Claude Code Opus 5 Auto Mode"
section: "raw"
type: "source"
created: "2026-08-29"
updated: "2026-08-29"
canonical: "https://pyweb.dev/wiki/raw/articles/simon-willison-breaking-claude-code-opus-5-auto-mode-2026"
---
# Breaking Claude Code Opus 5 Auto Mode

Breaking Claude Code Opus 5 Auto Mode
Simon Willison’s Weblog
Subscribe
Sponsored by: Greptile — The Al code reviewer that runs your code. Catch bugs that only show up at runtime. Try it for free
27th August 2026 - Link Blog
Breaking Claude Code Opus 5 Auto Mode. Anthropic are putting a great deal of faith in Claude Code's auto mode for protecting their coding agent users against prompt injection attacks. They recently made that the default and have made bold claims about its effectiveness.
Johann Rehberger is one of the most credible prompt injection researchers active today. He found an attack against auto mode which he claims works 80% of the time, by tricking Claude Code into downloading and uncompressing a zip archive, then executing code that imports base64 without noticing that this will import and execute a local struct.py file extracted from the archive.
In a few cases auto mode directly prevented the agent from preventing harmful code from continuing to execute!
In a few runs Claude tried to terminate the malware process once it noticed the compromise, but Auto Mode denied the cleanup command.
Claude detects the compromise, but Auto Mode blocks its cleanup command
The safety mechanism itself can become part of the failure. The classifier allowed the creation of the malware process, but then it blocked the command intended to stop it!
I agree with Johann's conclusion here: the only safe way to run agents if there's any risk of attracting the attention of an adversarial attack is with a sandbox:
Run unattended coding agents in a container, VM or OS sandbox.
Restrict network egress.
Monitor your agents.
Do not expose home directories, SSH keys, cloud credentials,… to the agent runtime. [...]
Posted 27th August 2026 at 10:50 pm
Recent articles
Conceptual integrity and counting lines of code - 19th August 2026
Qwen 3.8 27B is excellent, but it defaults to wildly overthinking things - 16th August 2026
Now we have a timeline of the OpenAI accidental attack against Hugging Face - 7th August 2026
This is a link post by Simon Willison, posted on 27th August 2026.
sandboxing
55
security
628
ai
2,205
prompt-injection
162
generative-ai
1,954
llms
1,921
anthropic
332
claude
304
johann-rehberger
19
claude-code
125
Monthly briefing
Sponsor me for $10/month and get a curated email digest of the month's most important LLM developments.
Pay me to send you less!
Sponsor & subscribe
Disclosures
Colophon
©
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026

---

## Agent Navigation

### Machine endpoints
- Knowledge graph: https://pyweb.dev/api/graph.json
- Graph analysis: https://pyweb.dev/api/graph-analysis.json
- Context index: https://pyweb.dev/llms.txt