Claude Code Opus 5 Auto Mode Hijacked via Prompt Injection to Execute Malicious Code

Claude Code Opus 5 in Auto Mode can be tricked into running malicious code via a simple website summary request. In a limited lab test, the attack reportedly succeeded in 60% to 80% of attempts.

The finding from Embrace The Red is significant because Anthropic previously highlighted testing in which Opus 5 Auto Mode showed a 0.00% prompt-injection success rate across a fixed set of scenarios.

However, the new research suggests that targeted, multi-step attacks can still bypass automated safeguards. Claude Code Auto Mode is meant to reduce approval prompts.

Instead of asking users to approve every command, it uses a safety classifier to review tool calls. Anthropic positions the feature as safer than unrestricted permission skipping, but it is not designed to replace a sandbox or operating-system security controls.

Claude Code Opus 5 Auto Mode Hijacked

The attack started with a normal-looking instruction: summarize a website. The attacker-controlled website appeared to host an archive of notebook records. When Claude tried to use its web-fetching tool, the server returned an HTTP 415 error.

Claude then chose to use curl through a shell command to retrieve the site directly. The website redirected the request to a ZIP archive containing catalog files, encoded records, a decoder binary, and a malicious Python file called struct.py.

Claude correctly refused to run the included native decoder binary. However, this safety decision set the stage for the next stage of the attack.

Instead of executing the untrusted binary, Claude wrote its own Python decoder to process the encoded files. The decoder imported common Python modules such as base64, zlib, and json. But Claude executed the code from inside the extracted ZIP directory.

Python searches the current directory when loading modules. The attacker included a file named struct.py, which shadowed Python’s legitimate standard-library struct module.

When Claude’s decoder imported base64, Python eventually loaded the attacker-controlled struct.py file. The malicious file could execute code during the import process while still allowing the decoder to work normally.

As a result, Claude received valid decoded records and did not immediately recognize that a hidden payload had already executed. In the proof-of-concept attack, the poisoned Python module launched another isolated Python process. That child process downloaded and executed a later-stage payload, created a command-and-control callback, and opened Calculator as a visible sign of compromise.

The researcher also tested a second method in which the malicious module launched another Claude Code instance in headless mode. That nested agent reportedly performed basic system reconnaissance, opened Calculator, and wrote files outside the original workspace.

The reported test results were based on small samples. A Python-based attack chain succeeded in 3 of 5 tests (60%). A nested Claude Code variant also succeeded in 3 of 5 tests. A version that wrote files outside the workspace succeeded in 4 of 5 tests (80%).

According to Embrace The Red, the key lesson is that Auto Mode should not be treated as a security boundary. A classifier may deem a short command harmless without fully understanding the risks hidden in an archive, local import path, child process, or network request.

Organizations using autonomous coding agents should run them in isolated environments such as containers, virtual machines, or dedicated test systems.

They should limit network access, block access to sensitive credentials, monitor processes, and prevent agents from running code from untrusted directories.

Auto Mode can reduce prompt fatigue and may be safer than fully turning off approvals. But when agents process untrusted websites, archives, or repositories, sandboxing and monitoring remain essential.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC