Security researcher Johann Rehberger has published technical details on a multi-stage exploit chain that achieves arbitrary code execution against Claude Code Opus 5 running in Auto Mode. The attack demonstrates how adversarial files can bypass Anthropic's safety classifiers and prompt injection defenses by exploiting standard runtime behavior in Python.
Anthropic rolled out Auto Mode as the default starting mode for Claude Code in mid-August 2026. Auto Mode replaces explicit human permission prompts with automated safety classifiers and layered input filters. A third-party evaluation by Trajectory Labs cited by Anthropic reported a 0.00% indirect prompt injection attack success rate across 72 test scenarios. However, Rehberger demonstrated an attack success rate between 60% and 80% using a targeted adversarial workflow.
The Attack Chain: From Web Retrieval to Python Module Shadowing
The exploit begins when Claude Code is tasked with summarizing an external web domain. When the agent attempts to fetch the target URL using its internal WebFetch tool, the attacker's web server responds with an HTTP 415 Unsupported Media Type status. This forces the model to fall back to using command-line tools such as curl via Bash.
The server then issues an HTTP 303 redirect pointing to a ZIP archive containing encoded files, catalogue metadata, a compiled macOS binary labeled as a decoder, and a Python script named struct.py.
Claude Code's internal safety checks correctly identify the supplied compiled binary as untrusted and refuse to execute it. Instead, the agent writes and executes its own Python script to decode the records directly using standard library modules such as base64 and zlib.
This safety decision triggers the actual vulnerability. Because Claude executes Python within the extracted directory, Python places that directory at the beginning of its module search path. When the standard base64 module imports the built-in struct module, Python imports the attacker-supplied struct.py instead of the system library.
Process Detachment and Classifier Inversion
During module initialization, the malicious struct.py launches a background process using python3 -I to avoid recursive shadowing loops. The detached process fetches a second-stage payload from an external server, writes it to disk, and executes a command-and-control agent.
In several test runs, Rehberger observed that after the initial execution, Claude Code inspected the workspace files, detected the malicious nature of struct.py, and attempted to terminate the running payload. However, Auto Mode's safety classifier intervened and blocked Claude's own process-termination command, preventing the agent from killing the rogue background process.
In an alternative variation of the attack, the poisoned script invoked headless Claude Code CLI sessions (claude -p), creating child agents with their own context and tool permissions to perform local reconnaissance.
Implications for Coding Agent Sandboxes
The findings highlight a fundamental architectural limitation of relying on semantic model classifiers as security perimeters. While model classifiers and input filters can intercept direct prompt injections, they do not enforce operating system-level boundaries.
Security researchers emphasize that autonomous coding agents operating on untrusted data require strict isolation mechanisms:
- Running agent runtimes inside ephemeral virtual machines or hardened containers.
- Restricting outbound network access to allowlisted package repositories and APIs.
- Enforcing strict path permissions to prevent access to user home directories, SSH keys, and cloud credentials.
- Utilizing explicit process execution controls rather than relying solely on automated intent classifiers.
