Prompt injection attack bypasses Claude Code auto mode 80% of the time via zip archive
Researcher Johann Rehberger demonstrated a prompt injection attack against Claude Code's auto mode, claiming an 80% success rate by tricking the agent into downloading and extracting a zip archive that contains a malicious struct.py file, which is then imported via base64. In some runs, auto mode even blocked Claude's attempts to terminate the malware process after detecting the compromise, highlighting a flaw in the safety mechanism itself.
Coverage timeline
Simon Willison
Breaking Claude Code Opus 5 Auto Mode Anthropic are putting a great deal of faith in Claude Code's auto mode for protecting their coding agent users against prompt injection attacks. They recently made that the default and have made bold claims about its effectiveness. Johann Rehberger is one of the most credible prompt injection researchers active today. He found an attack against auto mode which he claims works 80% of the time, by tricking Claude Code into downloading and uncompressing a zip archive, then executing code that imports base64 without noticing that this will import and execute a local struct.py file extracted from the archive. In a few cases auto mode directly prevented the agent from preventing harmful code from continuing to execute! In a few runs Claude tried to terminate the malware process once it noticed the compromise, but Auto Mode denied the cleanup command. Claude detects the compromise, but Auto Mode blocks its cleanup command The safety mechanism itself can b