A security score of 0.00% sounds like the sort of number that ends an argument. It did not end this one.

On August 26, security researcher wunderwuzzi published a controlled demonstration against Claude Code Opus 5 running in Auto Mode. The test did not rely on the tired “ignore previous instructions” trick. A website offered a harmless-looking archive. Claude fetched it, decoded its contents, and wrote a replacement decoder after refusing to run an included binary. A file inside that extracted directory was named struct.py. Python then loaded that file when a normal library import reached for struct.

The result was code execution in the researcher’s lab. The reported results were 3 of 5 and 4 of 5 runs. The 4 of 5 variant wrote outside the workspace. Those are small samples, not a population estimate. They are still enough to answer the question most people actually have: can Auto Mode replace a sandbox when an agent handles material from the open internet? No.

Claude Code Auto Mode attack chain from archive extraction to code execution

The number is narrower than it sounds

The apparent contradiction is easy to explain once the two tests are placed next to each other. Anthropic’s evaluation used 72 indirect prompt injection scenarios and ran each scenario 10 times. The public result for Opus 5 in Auto Mode was 0.00%. The researcher’s test used a different chain, with a malicious archive, an unsafe working directory, Python module shadowing, and several hops before the payload ran.

Both results can be true. That is exactly the problem with presenting a narrow test result as if it described the whole threat.

The disclosed chain also differs from a classic prompt injection in a useful way. The agent’s goal did not visibly change. It was still trying to summarize records. The mistake was operational: it trusted code it had just written, ran that code from an attacker-controlled directory, and did not treat a standard-library name collision as a boundary violation. Several Hacker News commenters made this distinction. They called the technique a trojan or an unsafe execution path rather than a prompt injection. The label matters less than the control it exposes. A model can pursue the requested task and still cross a host boundary while doing it.

The disclosure reports that the classifier sometimes recognized the compromise later. In a few runs, Auto Mode then denied the cleanup command. That creates an ugly asymmetry. The safety layer allowed the process that caused the damage, then blocked the command intended to stop it. A classifier can reduce risky actions. It cannot undo a process that already escaped its intended scope.

What the attack chain actually exploits

The most important step is not the archive format. It is the combination of untrusted files and code execution in the same directory.

A Python program does not need to modify the standard library to confuse an import. If the current working directory contains a file with a name that a library imports, Python can resolve the local file first. The researcher used struct.py as the trap. The replacement decoder looked reasonable because Claude had written it itself. The malicious behavior sat in a dependency imported by that decoder, several steps away from the original user request.

That is why “the model refused to run the supplied binary” is not a sufficient defense. Refusing one obvious payload can push the agent toward a fresh script that appears safer. The safe-looking path can still execute attacker-controlled code through imports, shell startup files, package metadata, symlinks, document converters, or build hooks. This is the same family of boundary mistake discussed in our earlier parser-bug analysis, although the failure here happens inside an agent workflow rather than a local model parser.

The small sample needs a fair reading. Three successes out of five do not mean every Claude Code session has a 60% compromise probability. The test author says the payload was iterated with coding models and that the variants were tested in a lab. The useful claim is narrower: a motivated attacker can make a multi-step chain work often enough that a permission classifier should not be treated as the final wall.

There is also a product-specific lesson. The attack was tuned to Claude’s habits, including its tendency to switch tools after an HTTP error and to write short Python commands for decoding. Every user gets the same model behavior. That makes repeated habits easier to study and target. A general safety score can miss this kind of model-specific path.

The containment decision

If an agent only reads trusted source files and never launches code, Auto Mode may be a reasonable convenience. That is a much smaller claim than “safe for untrusted content.” The moment a workflow downloads archives, checks out pull requests, runs package installation, converts documents, or executes generated scripts, use an outer boundary.

Here is the rule I would use:

Workflow Auto Mode alone Minimum sensible control
Read and summarize files you created Usually acceptable Keep secrets outside the project
Review an unfamiliar repository Too permissive for a host workstation Container or disposable VM, restricted network
Download and extract archives Not sufficient Disposable workspace, no host credentials, egress controls
Run unattended coding tasks Not sufficient Dedicated VM or container with logging and teardown
Touch production systems or cloud credentials Never use as the only control Human checkpoint plus isolated runner

Anthropic’s current documentation describes Auto Mode as a classifier that reviews tool calls and blocks actions it considers irreversible, destructive, or outside the trusted environment. The same documentation lists permission modes and separate sandbox environments as different controls. That distinction is worth keeping in your head: one mechanism decides whether an action looks acceptable; the other limits what the process can reach.

For a practical setup, start with a disposable container or virtual machine. Mount only the project directory, preferably read-only until the task needs writes. Do not mount your home directory. Keep SSH keys, cloud credentials, browser profiles, password stores, and package-manager tokens out of the environment. Block outbound network access by default, then allow only the domains the task needs. Log process launches and filesystem writes so a late discovery does not become a mystery.

If the agent must access the network, assume downloaded content is hostile even when the page looks ordinary. Extract archives in a directory that is not used as the interpreter’s import path. Run decoders from a trusted parent directory. Prefer isolated interpreter modes where practical, but do not confuse one Python flag with a complete sandbox. Test the whole workflow with fake credentials and a disposable account before allowing real access.

The choice is simple. Use Auto Mode to reduce approval fatigue. Use isolation to limit damage. Those solve different problems, and the 0.00% number does not change that.

Sources