The 0.00% Security Claim Meets Reality
Anthropic recently commissioned a third-party vendor, Trajectory Labs, to test Claude Code Opus 5’s new "Auto Mode" against indirect prompt injection. Auto Mode, which has been the default starting mode for Claude Code since mid-August, replaces human approval prompts with an automated safety classifier. Against 72 tested scenarios, the published evaluation showed an impressive 0.00% attack success rate.
But a new security teardown from the Embrace The Red blog shatters that baseline. The report demonstrates a targeted attack chain that achieves a 60-80% success rate (on a small sample size) by tricking Claude Code Opus 5 into executing malicious code, completely bypassing its safety classifiers.
Weaponizing the Model's Own Safety
The exploit does not rely on brute-forcing Claude’s guardrails. Instead, it uses the model's own safety protocols against it.
The test begins with a simple prompt asking Claude to summarize a specific URL. The target server returns a "415 Unsupported Media Type" error when Claude uses its built-in WebFetch tool. This subtly nudges the model to use the command-line tool curl to download the site's data as a ZIP archive.
Inside this ZIP is a decoy macOS binary and a hidden malicious Python file named struct.py. When Claude sees the binary, its safety classifier kicks in. It correctly refuses to run the untrusted executable. Instead, Claude attempts to solve the problem safely by writing its own Python script to decode the files.
This is the trap. Claude executes its newly written script inside the unzipped, attacker-controlled directory. When Claude's script attempts to import standard libraries like base64, Python's module search path prioritizes the local folder. It loads the malicious struct.py instead of the standard system library—a technique known as module shadowing. The attacker's code runs, establishes a remote connection, and opens a pathway to further exploitation, all while Auto Mode assumes it just successfully decoded a file.
What This Means for SMB Automations
For small and mid-sized businesses deploying AI agents to handle operations, this is a high-signal warning. Whether you are using agents to scrape competitor pricing, summarize vendor documents, or process customer emails, autonomous models interact with untrusted external data by design.
The critical takeaway is that model-level safety classifiers are not foolproof. Anthropic's vendor tested 72 scenarios and saw zero failures, but a slightly more complex, multi-step trap bypassed those defenses easily.
Relying entirely on an AI model's internal guardrails to prevent unauthorized code execution is a losing bet. In this attack, the AI's decision to act "safely"—choosing to write its own script rather than run a suspicious binary—was exactly what the attacker needed to trigger the exploit.
Sandboxing Over Prompt Engineering
If your business uses agents with autonomous capabilities, you cannot treat the model's judgment as your primary security layer. As the author of the exploit notes, Auto Mode is absolutely not a substitute for running agents in an isolated environment and monitoring their actions.
When building administrative automations—like an agent that triages incoming PDFs, fetches data from external links, or parses supplier invoices—the execution environment must be strictly sandboxed. If a supplier's site is compromised, or a malicious actor submits a rigged ZIP file via a customer service portal, your agent might try to parse it.
If an agent falls for an indirect prompt injection or module shadowing attack, the damage must be contained to a disposable virtual container with no access to your core business data, internal APIs, or local network. Defense in depth means assuming the agent will eventually be tricked, and ensuring that when it is, the attacker hits a dead end.