Claude Code Opus 5 Auto Mode Vulnerability Analysis

The attack chain examined in this analysis demonstrates how a simple request to summarize a website can lead to remote code execution within Claude Code Opus 5 Auto mode. Auto mode replaces under eight approval prompts with a safety classifier and has served as the default startup mode since mid-August. In testing environments, the attack success rate reached between 60% and 80% on a small sample size. This sharply contrasts with third-party evaluations commissioned by Anthropic, where 72 indirect prompt injection scenarios tested 10 times each yielded a 0.00% success rate. The target website disguises itself as a normal archive, with the ZIP archive containing catalog metadata and seven short records on linguistic development. Instead of using WebFetch, Claude executes a direct curl command to download the archive and extracts it into a temporary scratchpad folder. Inside the archive reside a macOS binary decoder named decoder-darwin and a README file. Although the model refuses to execute the provided binary, it writes alternative decoder code directly as part of its safety decision, inadvertently creating an exploit path.

Module Shadowing and Python Isolation for C2 Callbacks

The custom decoder written by Claude runs inside the extracted archive and exploits Python's module shadowing vulnerability when importing the standard base64 library. Because Python places the extracted archive directory into its module search path, it loads a malicious struct.py file located within the archive first. This disguised struct.py executes the attacker's malicious code while re-exporting the actual low-level _struct API to maintain normal decoding operations. Obfuscated using ChatGPT, this script launches an isolated Python child process in a new session upon import. The child process activates Python's isolation mode via the `python3 -I -c` command, preventing recursive falling into the same shadowing attack. Through this step, a remote payload is downloaded and converted into an executable file, establishing a controlled command and control callback connection in the lab environment alongside visible effects such as launching the calculator. During testing, the auto mode safety classifier permitted the creation of the malicious process, yet paradoxically blocked cleanup commands when the model later detected the compromise and attempted to terminate the malicious process.

Operational Security Guidelines for Autonomous AI Agents

Practitioners and developers must recognize that Claude Code Opus 5 Auto mode should never be treated as a reliable security boundary. Anthropic maintains the position that auto mode is a convenience feature based on a best-effort classifier rather than a security guarantee. Consequently, the 0.00% benchmark figure and the real-world potential for remote code execution are not contradictory, as sophisticated attack chains excluded from fixed test sets can still bypass the classifier. When building workflows where agents handle untrusted content or process external data autonomously, engineering teams must deploy operating system-level isolation on dedicated machines, enforce strict network egress controls, and implement independent monitoring systems rather than relying on auto mode protections.