Top AI Product

Anthropic said Auto Mode’s prompt injection success rate was 0.00% in its fixed test scenarios. Security researcher Johann Rehberger just published an attack that lands 60-80% of the time.

The attack chain

This is a security disclosure against Claude Code, Anthropic’s agentic coding tool, in its default Auto Mode. Ask Claude to summarize a webpage. The page nudges it to download and unzip an archive hiding a malicious struct.py. Claude refuses to run the bundled decoder — good instinct — and writes its own, which imports base64. Python’s base64 pulls in struct, module shadowing loads the attacker’s local struct.py instead of the standard library, and the malicious code executes. The safety refusal is the exploit path.

Why it’s worse than prompt injection

Simon Willison calls it a “confused environment” attack: Claude behaved correctly at every step; the environment itself was poisoned. Guardrails that judge intent can’t see it. Nastier still: in some runs Claude noticed the compromise and tried to kill the process — Auto Mode denied the cleanup command. HN gave it 266 points, mostly aimed at that 0.00% claim. Every agent that runs code in your shell inherits this problem.

You Might Also Like

• Anthropic Makes Auto Mode the Default in Claude Code on August 14 Humans Only Caught 13 6 of Dangerous Commands Anyway
• Openai Codex Claude md Auto Import Makes Switching From Claude Code a two Click Move
• Claude Context Mode Might be the Best Thing Thats Happened to my Claude Code Sessions
• Anthropic Just Launched Code Review in Claude Code and 54 of prs now get Real Feedback
• Claude Replay Turns Your Anthropic Claude Code Sessions Into Shareable Video Like Replays