Researcher breaks Claude Code auto mode with 80% success rate
Source published ·Modelwire updated
Original coverage: Simon Willison ↗·How Modelwire adds context
The development
Anthropic's confidence in Claude Code's auto mode as a defense against prompt injection has been tested by a credible researcher. Johann Rehberger, a leading figure in prompt injection security, demonstrated an 80% success rate attack that exploits the agent's file handling capabilities. The vulnerability works by manipulating Claude Code into downloading and executing archived code, circumventing the safety mechanisms Anthropic recently made default. This finding exposes a critical gap between Anthropic's security posture and real-world attack surface, raising questions about whether current guardrails are sufficient for autonomous coding agents operating in production environments.
Modelwire’s AI-generated summary of coverage from Simon Willison.
Modelwire analysis
ExplainerOur AI-generated reading of the wider context and the next developments to watch.
The 80% success rate is the number that matters here, not just the existence of the vulnerability. An attack that works four out of five times against a default-on safety mechanism is not a theoretical edge case; it is a practical baseline for anyone deploying Claude Code in an environment where untrusted files can enter the workflow.
This is largely disconnected from recent activity in our archive, as we have no prior coverage of Claude Code, prompt injection research, or Anthropic's agentic safety posture to anchor against. That gap is itself worth noting: the security research community around agentic AI has been active for over a year, with Rehberger in particular publishing prompt injection work against multiple frontier systems, but that thread has not surfaced prominently in mainstream AI coverage. This story belongs to a growing body of work showing that safety defaults designed for conversational models do not transfer cleanly to agents that read, write, and execute files autonomously.
Watch whether Anthropic issues a specific patch or configuration change to Claude Code's archive-handling behavior within the next four weeks. If they do not, that signals the fix is either architecturally difficult or deprioritized, which would be relevant for any enterprise evaluating the tool for production use.
This interpretation is generated from the summary above and available source metadata. Our methodology · Report an error
MentionsAnthropic · Claude Code · Johann Rehberger · Claude Code Opus 5
How this coverage is produced
Modelwire uses AI to generate summaries and context from source headlines, snippets, and selected archive coverage. Automated checks do not verify every claim, and items are not routinely reviewed by a person before publication. Zacaria Solis operates the site. Read the linked source for the full evidence and report errors through our corrections process.
Modelwire summarizes, we don’t republish. Simon Willison originally reported this story as “Breaking Claude Code Opus 5 Auto Mode”. The full content lives on simonwillison.net. If you’re a publisher and want a different summarization policy for your work, see our takedown page.