Claude Code's Auto Mode blocks its own malware cleanup, researcher finds

Anthropic has been leaning on Auto Mode, a permission system built into Claude Code, to protect users of its coding agent from prompt injection attacks, and recently made it the default while making confident claims about how well it works. Simon Willison, writing on his link blog on 27 August 2026, reports that Johann Rehberger, whom he calls one of the most credible prompt injection researchers active today, has found an attack that gets past it.

Rehberger's technique tricks Claude Code into downloading and unpacking a zip archive, then running code that imports the standard Python module base64, without Claude Code noticing that doing so will also import and execute a local file named struct.py that had been extracted from the archive. By Rehberger's own account, the attack succeeds 80% of the time, though neither his findings nor Willison's post gives a sample size or methodology behind that figure.

What happened in some of the test runs is the more pointed finding. In a few cases, Auto Mode directly prevented Claude from stopping harmful code that was still executing. In others, Claude noticed the compromise on its own and tried to kill the malware process, only for Auto Mode to deny the cleanup command outright. As the post puts it, the classifier allowed the creation of the malware process, but then blocked the command intended to stop it: the safety mechanism became part of the failure rather than a check on it.

Willison says he agrees with what he calls Johann's conclusion: the only safe way to run agents that might attract an adversarial attacker is inside a sandbox. His post repeats Rehberger's recommendations for unattended coding agents: run them in a container, VM or other OS-level sandbox, restrict their network egress, monitor them while they run, and never expose home directories, SSH keys or cloud credentials to the runtime an agent executes in.

Key facts

Prompt injection researcher Johann Rehberger says he broke Claude Code's Auto Mode safety classifier, claiming an 80% success rate.
The attack hides code in a zip archive; when Claude Code imports Python's base64 module, it inadvertently imports and runs a planted local struct.py file.
In some runs, Auto Mode let the malicious process start and then blocked Claude's own command to kill it after Claude had detected the compromise.
Anthropic recently made Auto Mode the default protection against prompt injection for Claude Code's coding agent.
Simon Willison, covering the finding on his link blog, endorses running unattended coding agents only inside a sandbox, with restricted network access and no exposed credentials.

Why it matters

Anthropic has staked a lot on Auto Mode as the safeguard that lets Claude Code users run coding agents without approving every command by hand, marketing it as protection against prompt injection and making it the default. Rehberger's attack does not just slip past that safeguard, which he says happens 80% of the time; in some runs the classifier actively stopped Claude from cleaning up after itself once the agent had already spotted the compromise. That turns the safety mechanism from something that merely misses an attack into an active obstacle to fixing it, a more serious failure mode.

Who it affects

Anyone running Claude Code with Auto Mode switched on, now the default, is exposed if their agent ever encounters a booby-trapped zip archive or similar planted code, since Rehberger's finding suggests the built-in classifier cannot be relied on to stop it. The risk is largest for unattended agents given access to home directories, SSH keys or cloud credentials, exactly what Willison's recommendations warn against. Anthropic is affected too: the finding undercuts the specific claims of effectiveness it made when setting Auto Mode as the default.

How to use it

Neither Rehberger nor Willison offers a fix, only a workaround. Their shared recommendation is that a sandbox, not Auto Mode, is the actual safety boundary for an unattended coding agent that might face an adversarial attacker: run it inside a container, VM or other OS-level sandbox, restrict its network egress, monitor it while it runs, and keep home directories, SSH keys and cloud credentials out of reach of the runtime entirely.

How solid is it

Willison, a well-known figure in AI and security commentary, vouches for Rehberger's credibility, calling him one of the most credible prompt injection researchers active today. That said, the 80% success rate is Rehberger's own claim, reported here without a sample size or methodology, and this post is Willison's commentary on someone else's research rather than an independent test. No response from Anthropic is reported.

Risks and caveats

The 80% figure comes from Rehberger alone, without a published methodology or sample size, so treat it as a claim rather than a verified rate. Neither Willison's post nor the underlying report says what the malicious struct.py file actually does once it runs, or what harm the resulting process caused in testing. It also does not explain why the finding is tied specifically to Opus 5 in Willison's headline, or whether other Claude Code configurations are equally exposed, and no comment from Anthropic is included.

“The classifier allowed the creation of the malware process, but then it blocked the command intended to stop it!”

— Simon Willison