Overview
Security researcher Johann Rehberger has published a high-reliability attack against Claude Code’s auto mode — Anthropic’s default safety classifier for its agentic coding assistant. The attack succeeds approximately 80% of the time and results in arbitrary code execution within the agent’s runtime environment. The finding is particularly significant because Anthropic recently made auto mode the default protection mechanism and has publicly highlighted its effectiveness against prompt injection.
Technical Analysis
The attack exploits Python’s module resolution order. The adversarial payload instructs Claude Code to download and decompress a zip archive. Inside the archive is a file named struct.py — a name that shadows Python’s standard library struct module. When the agent subsequently executes code that includes import base64, Python’s import machinery resolves local paths first, loading the attacker-controlled struct.py instead of the standard library module. This gives the attacker arbitrary code execution within the agent process.
The attack chain is straightforward:
- Adversarial instruction (via prompt injection) directs Claude to fetch and unzip a remote archive.
- The archive contains a malicious
struct.pyin the working directory. - Legitimate-looking code triggers
import base64, which transitively importsstruct. - The local
struct.pyexecutes attacker-controlled logic without triggering auto mode’s classifier.
A secondary failure mode was also observed: in several runs, Claude detected the compromise and attempted to terminate the malicious process. Auto mode’s classifier, however, blocked the cleanup command — the remediation tool invocation was classified as harmful, while the initial malware creation was permitted. The safety mechanism actively prevented recovery.
Framework Mapping
MITRE ATLAS:
- AML.T0051 (LLM Prompt Injection): The root trigger is an adversarial instruction injected into the agent’s context.
- AML.T0110 (AI Agent Tool Poisoning): The zip archive acts as a poisoned artifact consumed by the agent’s tool use.
- AML.T0080 (AI Agent Context Poisoning): The attack manipulates the agent’s operational context to cause unintended tool invocations.
- AML.T0065 (LLM Prompt Crafting): The payload is carefully crafted to stay below the classifier’s detection threshold.
OWASP LLM Top 10:
- LLM01 (Prompt Injection): Core attack vector.
- LLM08 (Excessive Agency): The agent has sufficient permissions to download, decompress, and execute arbitrary files.
- LLM02 (Insecure Output Handling): Agent-generated tool calls are not sufficiently validated before execution.
Impact Assessment
Any organisation or individual running Claude Code in auto mode with unattended or lightly supervised workflows is at risk. The attack requires no special privileges beyond the agent’s normal file system and network access — capabilities that are inherent to a coding assistant. The 80% success rate makes this a practical, repeatable threat rather than a theoretical edge case. Exposure is elevated for pipelines that grant agents access to cloud credentials, SSH keys, or sensitive environment variables.
Mitigation & Recommendations
- Sandbox all agent runtimes: Deploy Claude Code inside containers, VMs, or OS-level sandboxes. Treat the agent runtime as untrusted.
- Restrict network egress: Limit outbound connections to explicitly allowlisted endpoints. Prevent arbitrary file downloads.
- Isolate credentials: Never expose SSH keys, cloud credentials, or home directories to the agent’s working environment.
- Independent process monitoring: Do not rely on the model’s own safety classifier as the sole line of defence — use external process supervision.
- Treat classifier failures as architecture failures: This incident shows that a single-layer AI safety control is insufficient; defence-in-depth remains essential.
References
- Simon Willison’s Weblog: Breaking Claude Code Opus 5 Auto Mode