Breaking Claude Code Opus 5 Auto Mode

This article discusses a security vulnerability discovered by researcher Johann Rehberger in Claude Code's Auto Mode, which Anthropic made default for protecting coding agents against prompt injection attacks. Rehberger found an attack that works 80% of the time by tricking the agent into downloading and executing a malicious zip archive. The attack exploits Python's base64 import to run local code. Notably, Auto Mode sometimes blocked the agent's own cleanup commands, worsening the compromise. The author agrees with Rehberger's recommendation to run unattended coding agents in sandboxes (containers, VMs, OS-level), restrict network egress, monitor agents, and avoid exposing sensitive credentials. This is a tech security article relevant to AI coding tools and best practices.