Auto Mode in Claude Code Is No Cure for Prompt Injection

Anthropic is pinning high hopes on the “auto mode” in Claude Code: it's meant to protect users of the coding agent from prompt injection attacks. The mode was recently turned on by default, and its launch came with bold claims about how effective it is. In practice, though, things turned out to be less rosy.

How the attack works

Johann Rehberger, one of the most respected prompt injection researchers, found a way around the protection that, by his account, works 80% of the time. The approach relies on a classic trick with Python import paths. The agent is convinced to download and unpack a zip archive and then run code that imports the standard base64 module. The catch is that this also quietly pulls in and executes a local struct.py file extracted from the same archive — and that file already carries the malicious payload. The security classifier lets such a scenario through.

Protection that gets in the way of protecting

The most curious part is how auto mode behaves after a compromise. In a number of runs, Claude noticed that the system was infected and tried to kill the malicious program's process. But the protective mechanism blocked precisely the cleanup command. In other words, the classifier calmly allowed the malicious process to be created, yet forbade the command that was supposed to stop it.

The result is a paradox: the security mechanism itself becomes part of the failure. It didn't prevent the infection, but it did prevent the agent from fixing the aftermath — Claude recognizes the compromise, and auto mode won't let it clean up.

The only reliable option is a sandbox

Commenting on the finding, Simon Willison agrees with Rehberger's conclusion: if there's any risk at all of running into a targeted attack, the only safe way to run agents is isolation. The recommendations are simple and familiar:

• run autonomous coding agents in a container, a virtual machine, or a system sandbox;
• restrict outbound network traffic;
• monitor the agents' actions;
• don't give the runtime environment access to home directories, SSH keys, cloud credentials, or other sensitive data.

The takeaway is discouraging for anyone counting on “smart” protection as a silver bullet: relying on a classifier that operates at the same level as a potentially compromised agent is risky. A dependable boundary is still drawn only by external isolation.

Source: Simon Willison