Breaking Claude Code Opus 5 Auto Mode

Anthropic has set Claude Code Opus 5’s Auto Mode as the default mode to defend against prompt injection attacks, but researcher Johann Rehberger discovered a security vulnerability in this mode. Tests showed that Rehberger successfully bypassed the protection by inducing the model to download and unzip a zip file containing malicious code, allowing it to perform local file operations. In some tests, even though Auto Mode detected abnormal behavior, it failed to prevent the execution of cleanup commands, allowing harmful code to continue running. Researchers recommend that if a proxy is at risk of adversarial attacks, it should be run in containers, virtual machines, or operating system sandboxes, with network outbound traffic restricted and proxy behavior monitored. Additionally, avoid exposing home directories, SSH keys, and cloud credentials to the proxy during operation.