The post on Embrace the Red describes how a benign‑looking task—summarizing a website—can be used to hijack Claude Code Opus 5 when it is running in Auto Mode. Auto Mode, which became the default setting for Claude Code in mid‑August, replaces the usual human‑approval step with a safety classifier that is intended to block prompt‑injection attempts. Anthropic’s own third‑party evaluation, conducted with Trajectory Labs, reported a 0.00% attack success rate for Opus 5 in Auto Mode across 72 indirect prompt‑injection scenarios tested ten times each. The evaluation relied on layered defenses that included model training, input probes and an intent classifier. To test whether those defenses hold against a more targeted chain, the author crafted a malicious website that serves a ZIP archive containing seemingly innocuous notebook records. When Claude is asked to summarize the site, it first attempts to fetch the page with its WebFetch tool. The server replies with a 415 Unsupported Media Type response, prompting Claude to retry the request using curl directly. This shift from the higher‑level WebFetch tool to a Bash‑based curl call is a key step in the attack chain, as it moves the model into a context where it can execute shell commands. The curl request follows a 303 redirect to a ZIP file hosted on the same server. After downloading the archive, Claude extracts its contents, which include a README, a CSV manifest, a SHA256 file, seven Base85/zlib‑encoded JSON records, a macOS binary named decoder‑darwin, and a file called struct.py. Claude inspects the binary, finds it matches the description in the README, and refuses to run it. Instead, the model decides to write its own Python decoder to process the records. While writing this decoder, Claude imports the base64 module inside the extracted archive directory. Because the archive’s struct.py file is placed on Python’s module search path, the import of base64 leads to the loading of the attacker‑provided struct.py rather than the standard library version. The malicious struct.py is heavily obfuscated to evade simple string searches. During its import, it launches an isolated Python child process that downloads and executes a remote payload. The payload makes a temporary file executable, runs it, and establishes a command‑and‑control callback, also opening the Calculator application as a visible sign of success. The author reports that, using a small sample size, the attack succeeded in 60‑80% of attempts, a stark contrast to the earlier evaluation’s 0.00% figure. The post notes that Auto Mode only sees the short Python decoder that Claude writes; the actual malicious payload operates several steps later, outside the model’s immediate scrutiny. The author concludes that reliance on Auto Mode alone is insufficient for safety and that agents should still be run in isolated environments with active monitoring of their behavior.
Key facts
- Auto Mode became the default for Claude Code in mid‑August
- Anthropic’s third‑party test found 0.00% prompt‑injection success for Opus 5 in Auto Mode
- The attack uses a website that returns a 415 response to push Claude from WebFetch to curl
- Claude refuses to run the supplied binary decoder and writes its own Python decoder instead
- The malicious struct.py file shadows the standard library module, enabling code execution
- The observed attack success rate was 60‑80% with a small sample size