Security researcher Johann Rehberger has uncovered a critical flaw in Claude Code's auto mode, demonstrating an exploit that bypasses the agent's defenses with an 80% success rate. The attack relies on an indirect prompt injection that coaxes the assistant into downloading and unpacking an untrusted ZIP archive. Once unpacked, Claude executes a routine importing base64, inadvertently executing a poisoned local struct.py module dropped from the archive instead of the standard library component.
Anthropic recently rolled out auto mode as a primary defense to protect autonomous coding agents against rogue prompts. The reality proved deeply ironic: in multiple test runs, the safety classifier permitted the creation of the malicious process in the first place, yet actively blocked Claude's own automated cleanup attempts once the model recognized the compromise. In effect, the guardrail shielded the malware from remediation.
Granting autonomous agents unconstrained access to a local filesystem and terminal without rigorous external isolation remains an indefensible operational risk. Relying on model-level classifiers for containment is fundamentally flawed; safe enterprise deployment requires hardened execution environments—disposable containers, locked-down VMs, restricted egress, and strict denial of access to SSH keys, cloud credentials, or home directories.