↓Skip to main content
Zeitgeist — a spike by Chris Gathercole
  1. Creators/
  2. Simon Willison — Creator of Datasette; co-creator of Django/

Breaking Claude Code Opus 5 Auto Mode

Blog · Watch/Read · (gathered 2026-08-29)

  • Simon Willison reports on a critical vulnerability found by Johann Rehberger in Anthropic’s Claude Code Opus 5 Auto Mode, which despite being the default for prompt injection protection, can be bypassed with high success.
  • Rehberger’s attack, effective 80% of the time, tricks Claude Code into downloading and executing malicious code from a zip archive by exploiting how it handles base64 imports to execute a local struct.py file.
  • Alarmingly, Auto Mode sometimes prevented Claude from terminating the detected malware process, turning the safety mechanism itself into a component of the failure.
  • The only safe way to run unattended coding agents is within a robust sandbox (container, VM, OS sandbox), with restricted network egress, active monitoring, and no exposure of sensitive credentials or directories to the agent runtime.